CVE-2003-0826: GNU Lsh

High severity, CVSS 7.5. EPSS: 12.1% chance of exploitation in the next 30 days.

lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.

Affected products

• GNU Lsh: version 1.4 only; version 1.4.1 only; version 1.4.2 only

Published 2003-10-06. Last modified 2026-06-16.