Log in Start free

Vulnerability · Published Jul 7, 2025 · Assigned by redhat

CVE-2025-5987Libssh: invalid return code for chacha20 poly1305 with openssl backend

High 8.1

In plain English

A high-severity security flaw in libssh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.7%top 22.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9libssh0.10.4-17.el9_7ALSA-2025:23483
AlmaLinux:10libssh-config0.11.1-5.el10_1ALSA-2025:23484
AlmaLinux:9libssh-config0.10.4-17.el9_7ALSA-2025:23483
AlmaLinux:9libssh-devel0.10.4-17.el9_7ALSA-2025:23483
Alpine:v3.22libssh0.11.2-r0ALPINE-CVE-2025-5987
Alpine:v3.23libssh0.11.2-r0ALPINE-CVE-2025-5987
Alpine:v3.24libssh0.11.2-r0ALPINE-CVE-2025-5987
Debian:12libssh0.10.6-0+deb12u2DEBIAN-CVE-2025-5987
Debian:13libssh0.11.2-1DEBIAN-CVE-2025-5987
Debian:14libssh0.11.2-1DEBIAN-CVE-2025-5987
Rocky Linux:10libssh0:0.11.1-5.el10_1RLSA-2025:23484
Rocky Linux:9libssh0:0.10.4-17.el9_7RLSA-2025:23483
Ubuntu:22.04:LTSlibssh0.9.6-2ubuntu0.22.04.4USN-7619-1
Ubuntu:24.04:LTSlibssh0.10.6-2ubuntu0.1UBUNTU-CVE-2025-5987
Ubuntu:24.04:LTSlibssh0.10.6-2ubuntu0.1USN-7619-1

Affected products (as reported)

VendorProductVersions
libssh 0.10.0 – before 0.11.2
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat OpenShift Container Platform 4.13 see references
Red Hat Red Hat OpenShift Container Platform 4.14 see references
Red Hat Red Hat OpenShift Container Platform 4.15 see references
Red Hat Red Hat OpenShift Container Platform 4.16 see references
Red Hat Red Hat OpenShift Container Platform 4.17 see references
Red Hat Red Hat OpenShift Container Platform 4.18 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.20 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat OpenShift Container Platform 4 see references

Weakness: CWE-393 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References