Low

Paramiko rsakey.py allows the SHA-1 algorithm

Disclosed: 06.05.2026
Updated: 11.10.2026 15:17

In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	paramiko	<= 4.0.0	no fix

References

CVSS score 3.4/10

CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness (CWE): CWE-327
Platform: Python (PyPI)
Package: paramiko
Disclosed: 06.05.2026
Updated: 11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2858 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-r374-rxx8-8654 - CC BY 4.0

Vulnerability history: paramiko

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 6
First → latest: 01.2008 05.2026
Without a fix: 1
Exploited in attacks: 0

Severity breakdown

Critical 1
High 3
Medium 1
Low 1

Disclosures per year

2017: 0
2018: 2
2019: 0
2020: 0
2021: 0
2022: 1
2023: 1
2024: 0
2025: 0
2026: 1

earlier: 1

06.05.2026

Paramiko rsakey.py allows the SHA-1 algorithm this entry

Low · 3.4 CVE-2026-44405 <= 4.0.0 no fix
18.12.2023

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

Medium · 5.9 CVE-2023-48795 >= 2.5.0, < 3.4.0 3.4.0
17.03.2022

Race Condition in Paramiko

High · 5.9 CVE-2022-24302 >= 2.10.0, < 2.10.1, >= 2.9.0, < 2.9.3 2.10.1, 2.9.3
08.10.2018

Paramiko Authentication Bypass vulnerability

High · 8.8 CVE-2018-1000805 >= 2.4.0, < 2.4.2, >= 2.3.0, < 2.3.3, >= 2.2.0, < 2.2.4, >= 2.1.0, < 2.1.6, >= 1.5.1, < 2.0.9 2.4.2, 2.3.3, 2.2.4, 2.1.6, 2.0.9
13.03.2018

Paramiko not properly checking authentication before processing other requests

Critical · 9.8 CVE-2018-7750 >= 2.0.0, < 2.0.8, >= 2.1.0, < 2.1.5, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.2, >= 2.4.0, < 2.4.1, >= 1.18.0, < 1.18.5, < 1.17.6 2.0.8, 2.1.5, 2.2.3, 2.3.2, 2.4.1, 1.18.5, 1.17.6
16.01.2008

common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by pred

High · 6.5 CVE-2008-0299 < 1.7.2 1.7.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application