This vulnerability in libssh 0.6.0 arises from failure to release memory during repeated incorrect key exchange guesses by a client. The memory leak occurs during rekey operations, which can cause gradual memory exhaustion and crashes on the client side, particularly when libgcrypt is involved. The issue impacts application stability and availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and only availability impact. The vendor advisory from Red Hat does not currently specify a patch or remediation status.

The vulnerability can cause gradual memory exhaustion on the client side during repeated incorrect key exchange attempts, potentially leading to application crashes and reduced availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-8277 for current remediation guidance. Until an official fix is available, users should monitor for updates from Red Hat. No vendor advisory indicates that the issue is already mitigated or requires no action.