CVE-2026-56766
published 2026-06-25CVE-2026-56766: Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and…
PriorityP263high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
1.32%
67.8th percentile
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vanhauser-thc | thc-hydra | <= 9.7 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
334 <base64-encoded NTLM Type-2 challenge with oversized domain>\r\n
- →Detect NTLM Type-2 challenge responses on SMTP (and POP3/IMAP/NNTP/HTTP) where the base64-encoded payload causes a 500-byte stack buffer overflow by 18–330 bytes; flag oversized NTLM Type-2 domain strings in server-to-client authentication exchanges. ↗
- →Monitor for rogue/malicious servers sending crafted NTLM Type-2 challenges with excessively long domain strings across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum protocols to Hydra clients. ↗
- →On SMTP, flag server responses beginning with '334 ' followed by an unusually large base64 blob during an AUTH NTLM handshake, as this matches the exploit's malicious server behaviour. ↗
- →Affected modules span SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum — detection logic should cover NTLM Type-2 challenge parsing across all these protocol handlers in Hydra. ↗
- ·Exploitation requires the victim to actively connect Hydra to an attacker-controlled server; passive exposure is not sufficient. ↗
- ·Systems with stack protection (e.g., stack canaries, NX) significantly reduce exploitability; RCE is only reliably achievable on systems without these mitigations. ↗
- ·Red Hat notes that standard built-in security features (stack protection) cause the application to safely shut down on overflow, blocking harmful commands from running. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
vanhauser-thc thc-hydra up to 9.7 Urlenum stack-based overflow
vuldb·2026-06-26·CVSS 8.8
CVE-2026-56766 [HIGH] vanhauser-thc thc-hydra up to 9.7 Urlenum stack-based overflow
A vulnerability categorized as critical has been discovered in vanhauser-thc thc-hydra up to 9.7. This issue affects some unknown processing of the component Urlenum Module. The manipulation results in stack-based buffer overflow.
This vulnerability is cataloged as CVE-2026-56766. The attack may be launched remotely. There is no exploit available.
It is advisable to implement a patch to correct this issue.
GHSA
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing mali
ghsa_unreviewed·2026-06-25
CVE-2026-56766 [HIGH] CWE-121 Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing mali
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.
Red Hat
hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow
vendor_redhat·2026-06-25·CVSS 8.8
CVE-2026-56766 [HIGH] CWE-120 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow
hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.
A flaw was found in Hydra. A malicious server can exploit a stack buffer overflow vulnerability in the NTLM authentication modules by sending a specially crafted NTLM Type-2 challenge. This can lead to an overflow of a stack
No detection rules found.
Bugzilla
CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow [fedora-all]
bugzilla·2026-06-29·CVSS 8.8
CVE-2026-56766 [HIGH] CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow [fedora-all]
CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems
Bugzilla
CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow [epel-all]
bugzilla·2026-06-29·CVSS 8.8
CVE-2026-56766 [HIGH] CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow [epel-all]
CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems w
Bugzilla
CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow
bugzilla·2026-06-25·CVSS 8.8
CVE-2026-56766 [HIGH] CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow
CVE-2026-56766 hydra: Hydra: Remote Code Execution via NTLM Authentication Stack Buffer Overflow
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.
2026-06-25
Published