CVE-2025-8277 is a vulnerability in libssh's key exchange process where repeated incorrect key exchange guesses cause the library to fail to release allocated memory. This memory leak can accumulate over time, leading to exhaustion of system memory and crashes on the client side, especially when using libgcrypt. The issue affects libssh version 0.6.0 as used in Red Hat Enterprise Linux 10. Red Hat has acknowledged the vulnerability and issued a security advisory with patches available in updated libssh packages for Red Hat Enterprise Linux 9, which likely apply similarly to RHEL 10.

The vulnerability results in a denial of service condition due to memory exhaustion caused by unreleased memory during repeated key exchange attempts. This can cause client-side crashes and reduce application stability and availability. There is no impact on confidentiality or integrity. The CVSS score is 3.1 (low severity), reflecting the limited scope of impact.

Red Hat has released security updates for libssh that address this memory exhaustion vulnerability. Users should apply the official patches provided in the Red Hat Enterprise Linux 9 and 10 updates as referenced in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2025-8277). Patch status is confirmed by the vendor advisory. No additional mitigation steps are required beyond applying the official fix.