--- ./src/userauth.c_ORIG	2026-08-03 01:44:07.016873695 -0500
+++ ./src/userauth.c	2026-08-03 01:52:57.579986881 -0500
@@ -1,3 +1,4 @@
+
 /* Copyright (C) Sara Golemon <sarag@libssh2.org>
  * Copyright (C) Mikhail Gusarov <dottedmag@dottedmag.net>
  * Copyright (C) Daniel Stenberg
@@ -80,6 +81,12 @@
         memset(&session->userauth_list_packet_requirev_state, 0,
                sizeof(session->userauth_list_packet_requirev_state));
 
+		if(username_len > UINT32_MAX - 27) {
+            _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+                           "username_len out of bounds");
+            return NULL;
+        }
+
         session->userauth_list_data_len = username_len + 27;
 
         s = session->userauth_list_data =
@@ -307,6 +314,11 @@
          * 40 = packet_type(1) + username_len(4) + service_len(4) +
          * service(14)"ssh-connection" + method_len(4) + method(8)"password" +
          * chgpwdbool(1) + password_len(4) */
+		 if(username_len > UINT32_MAX - 40) {
+            return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+                                  "username_len out of bounds");
+        }
+
         session->userauth_pswd_data_len = username_len + 40;
 
         session->userauth_pswd_data0 =
@@ -447,7 +459,7 @@
                         }
 
                         /* basic data_len + newpw_len(4) */
-                        if(username_len + password_len + 44 <= UINT_MAX) {
+						if(username_len <= UINT32_MAX - password_len - 44) {
                             session->userauth_pswd_data_len =
                                 username_len + password_len + 44;
                             s = session->userauth_pswd_data =