Red Hat Security Advisory: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351) * libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878) * libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877) * libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114) * libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277) * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
AI Analysis
Technical Summary
This advisory covers a set of ten security vulnerabilities in libssh, including CVE-2025-5351 (double free in key export functions), CVE-2025-4878 (use of uninitialized variable in privatekey_from_file()), CVE-2025-4877 (write beyond bounds in binary to base64 conversion), CVE-2025-8114 (null pointer dereference in KEX session ID calculation), CVE-2025-8277 (memory exhaustion via repeated key exchange), CVE-2026-0966 (buffer underflow in ssh_get_hexa()), CVE-2026-0964 (improper sanitation of SCP server paths), CVE-2026-0965 (denial of service via improper config file handling), CVE-2026-0967 (denial of service via inefficient regex processing), and CVE-2026-0968 (denial of service due to malformed SFTP message). These vulnerabilities can lead to information disclosure, denial of service, or memory corruption. The issues affect libssh packages in Red Hat Enterprise Linux 9 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has published an update to address these vulnerabilities as detailed in advisory RHSA-2026:18683.
Potential Impact
The vulnerabilities collectively allow for potential information disclosure, denial of service conditions, and memory corruption in applications using libssh. The impact ranges from low to moderate, with some issues potentially causing application crashes or exhaustion of system resources. No known exploits in the wild have been reported at this time. The CVSS vector for CVE-2025-4877 indicates local attack vector with high attack complexity and low privileges required, resulting in low confidentiality, integrity, and availability impacts.
Mitigation Recommendations
Red Hat has released an official security update for libssh in Red Hat Enterprise Linux 9 that addresses all listed vulnerabilities. Users and administrators should apply the update as soon as possible following Red Hat's published guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigations are required beyond applying the vendor-provided patch.
Red Hat Security Advisory: libssh security update
Description
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351) * libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878) * libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877) * libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114) * libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277) * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
CVSS v3.1
Score 4.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers a set of ten security vulnerabilities in libssh, including CVE-2025-5351 (double free in key export functions), CVE-2025-4878 (use of uninitialized variable in privatekey_from_file()), CVE-2025-4877 (write beyond bounds in binary to base64 conversion), CVE-2025-8114 (null pointer dereference in KEX session ID calculation), CVE-2025-8277 (memory exhaustion via repeated key exchange), CVE-2026-0966 (buffer underflow in ssh_get_hexa()), CVE-2026-0964 (improper sanitation of SCP server paths), CVE-2026-0965 (denial of service via improper config file handling), CVE-2026-0967 (denial of service via inefficient regex processing), and CVE-2026-0968 (denial of service due to malformed SFTP message). These vulnerabilities can lead to information disclosure, denial of service, or memory corruption. The issues affect libssh packages in Red Hat Enterprise Linux 9 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has published an update to address these vulnerabilities as detailed in advisory RHSA-2026:18683.
Potential Impact
The vulnerabilities collectively allow for potential information disclosure, denial of service conditions, and memory corruption in applications using libssh. The impact ranges from low to moderate, with some issues potentially causing application crashes or exhaustion of system resources. No known exploits in the wild have been reported at this time. The CVSS vector for CVE-2025-4877 indicates local attack vector with high attack complexity and low privileges required, resulting in low confidentiality, integrity, and availability impacts.
Mitigation Recommendations
Red Hat has released an official security update for libssh in Red Hat Enterprise Linux 9 that addresses all listed vulnerabilities. Users and administrators should apply the update as soon as possible following Red Hat's published guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigations are required beyond applying the vendor-provided patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:18683
- Cve Count
- 10
- Additional Cves
- ["CVE-2025-4878","CVE-2025-5351","CVE-2025-8114","CVE-2025-8277","CVE-2026-0964","CVE-2026-0965","CVE-2026-0966","CVE-2026-0967","CVE-2026-0968"]
- Cvss Version
- 3.1
Threat ID: 6a1f4e86e29bf47b5007ef75
Added to database: 06/02/2026, 21:43:34 UTC
Last enriched: 07/04/2026, 01:54:05 UTC
Last updated: 07/31/2026, 19:22:55 UTC
Views: 138
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.