CVE-2026-4541 Details
Description
A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended.
A signature malleability vulnerability exists in Janmojzis TinySSH versions through 20250501. The issue arises in the Ed25519 signature verification component, specifically within the file 'tinyssh/crypto_sign_ed25519_tinyssh.c'. The vulnerability stems from an improper verification of the cryptographic signature, as the implementation fails to fully validate the scalar 'S' during signature verification, in accordance with the requirements of RFC 8032. This oversight allows an attacker to manipulate a valid signature by adding multiples of the Ed25519 group order 'L' to the scalar 'S', creating a non-canonical signature that is still accepted as valid. While this does not directly compromise private keys, it undermines the uniqueness of signatures and can disrupt protocols that rely on signature integrity.
Users are advised to upgrade to Janmojzis TinySSH version 20260301, which includes the necessary fix for this vulnerability. The updated version is available on the TinySSH GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 22, 2026CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/janmojzis/tinyssh/ | [email protected] | ProductSource CodeVendor |
| https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17 | [email protected] | Source CodeVendor |
| https://github.com/janmojzis/tinyssh/issues/101 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/janmojzis/tinyssh/pull/102 | [email protected] | Issue TrackingVendor |
| https://github.com/janmojzis/tinyssh/releases/tag/20260301 | [email protected] | Release NotesVendor |
| https://vuldb.com/submit/774687 | [email protected] | |
| https://vuldb.com/vuln/352358 | [email protected] | |
| https://vuldb.com/vuln/352358/cti | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| janmojzis tinyssh | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 18, 2026 | CVE Modified | [email protected] |
| Mar 22, 2026 | New CVE Received | [email protected] |