CVE-2026-44405

EUVD-2026-27514
In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.4 LOW
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.47%
Debian logo
Debian Releases
Debian Product
Codename
paramiko
bookworm
ignored
bullseye
ignored
forky
vulnerable
sid
vulnerable
trixie
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
paramiko
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python-paramiko-doc
suse enterprise sap 15 SP4
3.4.0-150400.13.13.1
fixed
suse enterprise server 15 SP4
3.4.0-150400.13.13.1
fixed
python3-paramiko
suse enterprise server 15 SP4
3.4.0-150400.9.9.1
fixed
python3-paramiko-doc
suse enterprise server 15 SP4
3.4.0-150400.9.9.1
fixed
python311-paramiko
suse enterprise sap 15 SP4
3.4.0-150400.13.13.1
fixed
suse enterprise server 15 SP4
3.4.0-150400.13.13.1
fixed
Common Weakness Enumeration
References
https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb
https://ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-audit_v1.1.pdf