CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

As cited

Copy frozen at 2026-10-21 23:22 UTC (site build).

vulnerabilities

CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

Net::LibSSH, a Perl module, fails to verify host keys against the known_hosts file when connecting to servers in versions before 0.004. This allows connections to proceed to unverified servers, creating an opportunity for man-in-the-middle attacks.

Why it matters: Developers using Net::LibSSH for Perl applications must update to version 0.004 or later to prevent unencrypted or intercepted connections to untrusted servers.

Source published

2026-10-21 21:58 UTC

First seen by Cybersecurity Tracker

2026-10-21 22:40 UTC