CVE-2026-94423 GETTY CVE debrief

Who should care

Perl developers and administrators using Net::LibSSH should assess exposure and prioritize updating to version 0.004 or later to mitigate potential security risks. This includes reviewing current deployments, identifying systems that use affected versions of Net::LibSSH, and ensuring that updates are applied to prevent potential man-in-the-middle attacks and the interception of sensitive information.

Why it matters

CVE-2026-94423 is significant for Perl developers and administrators using Net::LibSSH versions before 0.004. The vulnerability allows for potential man-in-the-middle attacks by not verifying the server's host key, which can lead to the interception of sensitive information and compromised SSH connections. Updating to version 0.004 or later is crucial to mitigate these security risks.

• Potential for man-in-the-middle attacks
• Interception of sensitive information
• Compromised SSH connections and sessions

Technical summary

The Net::LibSSH module for Perl, in versions before 0.004, does not properly verify the host key of the server during the connection process. This is because the connect function does not check the host key against the known_hosts file. As a result, an attacker could potentially redirect the connection and intercept sensitive information, such as passwords, when password authentication is used. The vulnerability allows for potential man-in-the-middle attacks, compromising SSH connections and sessions. This issue arises because libssh leaves the known-hosts check to the application, and the Net::LibSSH binding does not perform this check.

Defensive priority

High

Recommended defensive actions

• Review and update Net::LibSSH to version 0.004 or later
• Implement proper host key verification for SSH connections
• Monitor for and restrict unauthorized access to affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details about the vulnerability in Net::LibSSH versions before 0.004 for Perl. The connect function does not check the host key against known_hosts, which can lead to security risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.