What’s Vulnerable › Vulnerabilities

CVE-2026-44405: Paramiko rsakey.py allows the SHA-1 algorithm

• Severity: low (CVSS 3.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-06 · updated 2026-07-24
• Weakness: CWE-327

Description

In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

Affected products

• Pypi Paramiko: through 4.0.0; 0.1-bulbasaur, 0.1-charmander, 0.9-doduo, 0.9-eevee, 0.9-fearow, 0.9-gyarados (+144)

References

• https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb
• https://ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-audit_v1.1.pdf

Get alerted when CVE-2026-44405 or the next vulnerability affects your stack