CVE-2026-44405

EUVD-2026-27514
In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.4 LOW
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.71%
Debian logo
Debian Releases
Debian Product
Codename
paramiko
bookworm
ignored
bullseye
ignored
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
paramiko
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python-paramiko-doc
suse enterprise sap 15 SP4
3.4.0-150400.13.13.1
fixed
suse enterprise server 15 SP4
3.4.0-150400.13.13.1
fixed
python311-paramiko
suse enterprise sap 15 SP4
3.4.0-150400.13.13.1
fixed
suse enterprise server 15 SP4
3.4.0-150400.13.13.1
fixed
Common Weakness Enumeration
References
https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb
https://ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-audit_v1.1.pdf