Executive brief
Hydra, a popular network login hacking tool, is vulnerable to a security flaw when connecting to malicious servers. If an attacker lures a user into connecting to a compromised or malicious server using NTLM authentication, they can take control of the user's system. This could lead to the theft of sensitive data or the installation of malware on the machine running the tool.
Technical details
A stack-based buffer overflow (CWE-121) exists in Hydra's NTLM authentication handler across several modules, including SMTP, POP3, IMAP, NNTP, and HTTP. The vulnerability is triggered when the application processes a malicious NTLM Type-2 challenge containing an excessively long domain string. This causes base64-encoded response data to overflow a fixed 500-byte stack buffer by up to 330 bytes. An attacker controlling a remote server can exploit this to achieve remote code execution (RCE) on the client system, particularly those lacking modern stack protection mechanisms. The issue is fixed in commit 9cc84c2.
Affected products
- vanhauser-thc Hydra (thc-hydra) Up to and including 9.7
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
- 2026-06-25: patched: Fixed in commit 9cc84c2