The vulnerability CVE-2025-5987 in libssh arises from improper handling of OpenSSL error codes when using the ChaCha20 cipher. Specifically, an OpenSSL error code aliases with SSH_OK, causing libssh to fail to detect errors during heap exhaustion scenarios. This leads to libssh using a partially initialized cipher context, which can cause undefined behavior such as data confidentiality and integrity compromise or crashes. Red Hat has issued security advisories RHSA-2025:23483 and RHSA-2025:23484 providing updated libssh packages that fix this issue for Red Hat Enterprise Linux 9 and 10 respectively.

If exploited, this vulnerability can lead to compromised data confidentiality and integrity or cause crashes in applications using libssh with the ChaCha20 cipher and OpenSSL backend. The flaw stems from libssh not detecting certain OpenSSL errors, resulting in use of a partially initialized cipher context. This undermines the security guarantees of the SSH protocol implementation.

Red Hat has released official security updates that fix this vulnerability in libssh for Red Hat Enterprise Linux 9 and 10. Users should apply the updated libssh packages as described in Red Hat advisories RHSA-2025:23483 and RHSA-2025:23484. The advisories provide detailed instructions and updated package versions (e.g., libssh-0.10.4-17.el9_7 for RHEL 9 and libssh-0.11.1-5.el10_1 for RHEL 10). Applying these updates mitigates the vulnerability. Patch status is confirmed by the vendor advisories.