CVE-2026-44405
Fixed in a distro release EPSS <1%CVSS 3.4
In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
Products: paramiko
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | paramiko | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-3 | 3.2.1-r2 |
| Chainguard | authentik-2025.12 | no fix |
| Chainguard | authentik-2026.2 | no fix |
| Chainguard | authentik-2026.5 | 2026.5.6-r13 |
| Chainguard | authentik-fips-2025.12 | no fix |
| Chainguard | authentik-fips-2026.2 | no fix |
| Chainguard | authentik-fips-2026.5 | 2026.5.6-r14 |
| Chainguard | az | 2.90.0-r0 |
| Chainguard | datadog-agent-7.71-core-integrations | 7.71.2-r21 |
| Chainguard | datadog-agent-7.72-core-integrations | 7.72.4-r21 |
| Chainguard | datadog-agent-7.73-core-integrations | no fix |
| Chainguard | datadog-agent-7.74-core-integrations | 7.74.1-r15 |
| Chainguard | datadog-agent-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-7.76-core-integrations | no fix |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r7 |
| Chainguard | datadog-agent-7.78-core-integrations | 7.78.4-r18 |
| Chainguard | datadog-agent-7.79-core-integrations | 7.79.2-r3 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.73-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.74-core-integrations | 7.74.1-r26 |
| Chainguard | datadog-agent-fips-7.75-core-integrations | 7.75.4-r5 |
| Chainguard | datadog-agent-fips-7.76-core-integrations | 7.76.3-r35 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.78-core-integrations | 7.78.4-r17 |
| Chainguard | datadog-agent-fips-7.79-core-integrations | 7.79.2-r2 |
| Chainguard | datadog-agent-fips-7.80-core-integrations | 7.80.4-r2 |
| Chainguard | duplicity | 3.0.7-r4 |
| Chainguard | keep-api | 0.51.0-r6 |
| Chainguard | keep-api-fips | 0.51.0-r6 |
| Chainguard | nemo | 2.7.3-r2 |
| Chainguard | openstack-nova-2026.1 | 33.0.1_git20260616-r0 |
| Chainguard | pgadmin4 | 9.14-r2 |
| Chainguard | py3.11-paramiko | 5.0.0-r0 |
| Chainguard | py3.12-paramiko | 5.0.0-r0 |
| Chainguard | py3.13-paramiko | 5.0.0-r0 |
| Chainguard | superset-5.0 | 5.0.0-r32 |
| Chainguard | superset-6.0 | 6.0.0-r11 |
| Chainguard | superset-fips-6.1 | 6.1.0-r5 |
| Debian 12 | paramiko | no fix |
| Debian 13 | paramiko | no fix |
| Debian 14 | paramiko | no fix |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python3-paramiko | 3.4.0-150400.9.9.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-paramiko | 3.4.0-150400.13.13.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-paramiko | 3.5.1-150700.20.6.1 |
| SUSE Linux Enterprise Server 16.0 | python-paramiko | 3.5.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-paramiko | 3.5.1-160000.3.1 |
| Ubuntu 14.04 LTS | paramiko | no fix |
| Ubuntu 18.04 LTS | paramiko | no fix |
| Ubuntu 20.04 LTS | paramiko | no fix |
| Ubuntu 22.04 LTS | paramiko | no fix |
| Ubuntu 24.04 LTS | paramiko | no fix |
| Ubuntu 25.10 | paramiko | no fix |
| Ubuntu 26.04 LTS | paramiko | no fix |
| Ubuntu 26.10 | paramiko | no fix |
| Ubuntu Pro 16.04 LTS | paramiko | no fix |
| Wolfi | airflow-3 | 3.2.1-r2 |
| Wolfi | az | 2.90.0-r0 |
| Wolfi | datadog-agent-7.72-core-integrations | 7.72.4-r21 |
| Wolfi | datadog-agent-7.73-core-integrations | no fix |
| Wolfi | datadog-agent-7.74-core-integrations | 7.74.1-r15 |
| Wolfi | datadog-agent-7.75-core-integrations | no fix |
| Wolfi | datadog-agent-7.76-core-integrations | no fix |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r7 |
| Wolfi | datadog-agent-7.78-core-integrations | 7.78.4-r18 |
| Wolfi | datadog-agent-7.79-core-integrations | 7.79.2-r3 |
| Wolfi | py3.11-paramiko | 5.0.0-r0 |
| Wolfi | py3.12-paramiko | 5.0.0-r0 |
| Wolfi | py3.13-paramiko | 5.0.0-r0 |
| Wolfi | superset-6.0 | 6.0.0-r11 |
| openSUSE Leap 16.0 | python-paramiko | 3.5.1-160000.3.1 |
| openSUSE Tumbleweed | python-paramiko | 5.0.0-1.1 |