Describe the bug
azure-cli declares a dependency of paramiko<4.0.0,>=2.0.8. CVE-2026-44405 (CWE-327) affects all paramiko releases through 4.0.0 — the fix is exclusively in paramiko 5.0.0, which removes SHA-1 RSA signature support. Because azure-cli caps its dependency below 4.0.0, any project that depends on azure-cli cannot resolve paramiko 5.0.0, leaving consumers with no available pip-compatible remediation path for this CVE.
Related command
pip install azure-cli "paramiko>=5.0.0"
Errors
The conflict is caused by:
The user requested paramiko>=5.0.0
azure-cli 2.88.0 depends on paramiko<4.0.0 and >=2.0.8
ERROR: Cannot install azure-cli==2.88.0 and paramiko>=5.0.0 because these package versions have conflicting dependencies.
ERROR: ResolutionImpossible
Issue script & Debug output
N/A
Expected behavior
Installing azure-cli alongside paramiko>=5.0.0 resolves successfully
Environment Summary
N/A
Additional context
No response
Describe the bug
azure-cli declares a dependency of paramiko<4.0.0,>=2.0.8. CVE-2026-44405 (CWE-327) affects all paramiko releases through 4.0.0 — the fix is exclusively in paramiko 5.0.0, which removes SHA-1 RSA signature support. Because azure-cli caps its dependency below 4.0.0, any project that depends on azure-cli cannot resolve paramiko 5.0.0, leaving consumers with no available pip-compatible remediation path for this CVE.
Related command
pip install azure-cli "paramiko>=5.0.0"
Errors
The conflict is caused by:
The user requested paramiko>=5.0.0
azure-cli 2.88.0 depends on paramiko<4.0.0 and >=2.0.8
ERROR: Cannot install azure-cli==2.88.0 and paramiko>=5.0.0 because these package versions have conflicting dependencies.
ERROR: ResolutionImpossible
Issue script & Debug output
N/A
Expected behavior
Installing azure-cli alongside paramiko>=5.0.0 resolves successfully
Environment Summary
N/A
Additional context
No response