libssh vulnerabilities (CVE-2025-4877)
Ronald Crane discovered that libssh incorrectly handled certain base64 conversions. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-4877) Ronald Crane discovered that libssh incorrectly handled the privatekey_from_file() function. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-4878) Ronald Crane discovered that libssh incorrectly handled certain memory operations in the sftp server. An attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2025-5318, CVE-2025-5449) Ronald Crane discovered that libssh incorrectly handled exporting keys. An attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-5351) Ronald Crane discovered that libssh incorrectly handled the ssh_kdf() function. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-5372) Ronald Crane discovered that libssh incorrectly handled the ChaCha20 cipher. An attacker could possibly use this issue to cause libssh to use partially initialized cypher content. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-5987)
AI Analysis
Technical Summary
This advisory covers a set of ten security vulnerabilities in libssh, including CVE-2025-5351 (double free in key export functions), CVE-2025-4878 (use of uninitialized variable in privatekey_from_file()), CVE-2025-4877 (write beyond bounds in binary to base64 conversion), CVE-2025-8114 (null pointer dereference in KEX session ID calculation), CVE-2025-8277 (memory exhaustion via repeated key exchange), CVE-2026-0966 (buffer underflow in ssh_get_hexa()), CVE-2026-0964 (improper sanitation of SCP server paths), CVE-2026-0965 (denial of service via improper config file handling), CVE-2026-0967 (denial of service via inefficient regex processing), and CVE-2026-0968 (denial of service due to malformed SFTP message). These vulnerabilities can lead to information disclosure, denial of service, or memory corruption. The issues affect libssh packages in Red Hat Enterprise Linux 9 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has published an update to address these vulnerabilities as detailed in advisory RHSA-2026:18683.
Potential Impact
The vulnerabilities collectively allow for potential information disclosure, denial of service conditions, and memory corruption in applications using libssh. The impact ranges from low to moderate, with some issues potentially causing application crashes or exhaustion of system resources. No known exploits in the wild have been reported at this time. The CVSS vector for CVE-2025-4877 indicates local attack vector with high attack complexity and low privileges required, resulting in low confidentiality, integrity, and availability impacts.
Mitigation Recommendations
Red Hat has released an official security update for libssh in Red Hat Enterprise Linux 9 that addresses all listed vulnerabilities. Users and administrators should apply the update as soon as possible following Red Hat's published guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigations are required beyond applying the vendor-provided patch.
libssh vulnerabilities (CVE-2025-4877)
Description
Ronald Crane discovered that libssh incorrectly handled certain base64 conversions. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-4877) Ronald Crane discovered that libssh incorrectly handled the privatekey_from_file() function. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-4878) Ronald Crane discovered that libssh incorrectly handled certain memory operations in the sftp server. An attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2025-5318, CVE-2025-5449) Ronald Crane discovered that libssh incorrectly handled exporting keys. An attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-5351) Ronald Crane discovered that libssh incorrectly handled the ssh_kdf() function. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-5372) Ronald Crane discovered that libssh incorrectly handled the ChaCha20 cipher. An attacker could possibly use this issue to cause libssh to use partially initialized cypher content. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-5987)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers a set of ten security vulnerabilities in libssh, including CVE-2025-5351 (double free in key export functions), CVE-2025-4878 (use of uninitialized variable in privatekey_from_file()), CVE-2025-4877 (write beyond bounds in binary to base64 conversion), CVE-2025-8114 (null pointer dereference in KEX session ID calculation), CVE-2025-8277 (memory exhaustion via repeated key exchange), CVE-2026-0966 (buffer underflow in ssh_get_hexa()), CVE-2026-0964 (improper sanitation of SCP server paths), CVE-2026-0965 (denial of service via improper config file handling), CVE-2026-0967 (denial of service via inefficient regex processing), and CVE-2026-0968 (denial of service due to malformed SFTP message). These vulnerabilities can lead to information disclosure, denial of service, or memory corruption. The issues affect libssh packages in Red Hat Enterprise Linux 9 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has published an update to address these vulnerabilities as detailed in advisory RHSA-2026:18683.
Potential Impact
The vulnerabilities collectively allow for potential information disclosure, denial of service conditions, and memory corruption in applications using libssh. The impact ranges from low to moderate, with some issues potentially causing application crashes or exhaustion of system resources. No known exploits in the wild have been reported at this time. The CVSS vector for CVE-2025-4877 indicates local attack vector with high attack complexity and low privileges required, resulting in low confidentiality, integrity, and availability impacts.
Mitigation Recommendations
Red Hat has released an official security update for libssh in Red Hat Enterprise Linux 9 that addresses all listed vulnerabilities. Users and administrators should apply the update as soon as possible following Red Hat's published guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigations are required beyond applying the vendor-provided patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:18683
- Cve Count
- 10
- Additional Cves
- ["CVE-2025-4878","CVE-2025-5351","CVE-2025-8114","CVE-2025-8277","CVE-2026-0964","CVE-2026-0965","CVE-2026-0966","CVE-2026-0967","CVE-2026-0968"]
- Cvss Version
- 3.1
Threat ID: 6a1f4e86e29bf47b5007ef75
Added to database: 06/02/2026, 21:43:34 UTC
Last enriched: 07/04/2026, 01:54:05 UTC
Last updated: 09/14/2026, 16:19:08 UTC
Views: 179
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.