CVE-2026-56766: Hydra NTLM Stack Buffer Overflow RCE Vulnerability

Technical summary

CVE-2026-56766 is a stack buffer overflow (CWE-121) in Hydra's NTLM authentication implementation across multiple modules: SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum. The vulnerability is triggered when processing a malicious NTLM Type-2 challenge with an excessively long domain string. The base64-encoded response data overflows a 500-byte stack buffer by 18 to 330 bytes, depending on the crafted input. On systems without stack protection mechanisms (ASLR, stack canaries, DEP), this enables remote code execution. The fix is available in commit 9cc84c2.

Business impact

Organizations using Hydra for authorized penetration testing or security assessments face potential compromise of their testing infrastructure if operated against untrusted or attacker-controlled targets. The tool runs with the privileges of the user executing it; successful exploitation could grant an attacker equivalent access. In red-team scenarios, this creates an operational security risk where the testing system itself becomes a pivot point. Development and security teams relying on Hydra should prioritize patching to prevent supply-chain style risks if tools are shared across infrastructure.

Affected systems

Hydra through version 9.7 is affected. The vulnerability manifests across NTLM authentication pathways in SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules. Any system running an unpatched Hydra binary and performing authentication testing against untrusted targets is at risk. The fix is available in commit 9cc84c2; users should verify their deployed version against the project repository to confirm patched status.

Exploitability

Exploitation requires an attacker to control a target server that Hydra will attempt to authenticate against. The attack is network-accessible with no authentication barriers—an attacker simply crafts a malicious NTLM Type-2 response and waits for Hydra to connect. User interaction is required in the sense that a Hydra operator must initiate a scan against the attacker's server, making this primarily a risk in scenarios where red-teamers target untrusted infrastructure or where adversaries can inject malicious hosts into a target list. Systems with stack protection (DEP, ASLR, or stack canaries) may reduce exploitability, but the underlying overflow remains present.

Remediation

Update Hydra to a version incorporating commit 9cc84c2 or later. Verify with the upstream Hydra project repository for the exact release version or rebuild from the patched commit. If immediate patching is not possible, restrict Hydra usage to testing against trusted, controlled targets and avoid scanning untrusted or Internet-facing servers. Implement network segmentation to limit the blast radius if a Hydra system is compromised. Consider deploying host-based exploit mitigations (ASLR, DEP, stack canaries) on systems running Hydra.

Patch guidance

Consult the official Hydra project repository to identify the release version that includes commit 9cc84c2. Apply the update across all systems where Hydra is deployed. Verify the patched version by checking the commit history and release notes. If running Hydra from source, rebuild from the patched commit. For binary distributions, obtain updates from trusted package repositories. Test the patched version in a non-production environment before wide deployment.

Detection guidance

Monitor for outbound NTLM authentication attempts from Hydra processes, particularly to unexpected or external hosts. Network signatures can detect unusual NTLM Type-2 responses with abnormally long domain strings (exceeding typical lengths seen in legitimate authentication). Host-based detection should flag process execution of unpatched Hydra binaries (version 9.7 or earlier) combined with network authentication activity. Memory protection violations or crash dumps from Hydra processes may indicate exploitation attempts. Behavioral indicators include Hydra connecting to suspicious servers, high-volume authentication failures, or Hydra processes spawning unexpected child processes.

Why prioritize this

This is a HIGH severity vulnerability with a CVSS score of 8.8, reflecting remote code execution potential with low attack complexity. Although exploitation requires the target user to initiate a scan against an attacker-controlled server—limiting widespread risk—the consequences are severe for affected systems. Organizations using Hydra should treat this as a priority security update to prevent compromise of their testing infrastructure. The vulnerability's presence across multiple authentication modules increases the surface area and likelihood of incidental exposure during broad security testing campaigns.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network accessibility with no prerequisites (AV:N, AC:L, PR:N), (2) High impact across confidentiality, integrity, and availability on the affected system (C:H, I:H, A:H), and (3) user interaction required to initiate Hydra scan (UI:R), which slightly reduces but does not eliminate risk. The score appropriately captures the severity of unauthenticated remote code execution, tempered by the operational requirement that a user must actively connect to the attacker's server.

Frequently asked questions