CVE-2025-8114

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.(CVE-2025-8114)

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

• libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)

• libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)

• libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)

• libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)

• libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)

• libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

• libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

• libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

• libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

• libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Root has patched CVE-2025-8114 in the libssh package for Root:Debian:12. Multiple fixed versions available.

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

• libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)
• libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)
• libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)
• libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)
• libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)
• libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
• libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
• libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
• libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
• libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

• CVE-2025-5351: fix double-free conditions
• CVE-2025-8114: fix NULL pointer dereference

These are all security issues fixed in the libssh-config-0.11.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libssh fixes the following issues:

• Update to version 0.11.4:
• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
• CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
• CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)

This update for libssh fixes the following issues:

• CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX process is repeated with incorrect guesses (bsc#1249375).
• CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the KEX session ID (bsc#1246974).

This update for libssh fixes the following issues:

• CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX process is repeated with incorrect guesses (bsc#1249375).
• CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the KEX session ID (bsc#1246974).

This update for libssh fixes the following issues:

• CVE-2025-8114: Fixed NULL pointer dereference when calculating the session ID during the key exchange (KEX) process (bsc#1246974)
• CVE-2025-8277: Fixed Memory Exhaustion via Repeated Key Exchange (bsc#1249375)

This update for libssh fixes the following issues:

• CVE-2025-8114: Fixed NULL pointer dereference when calculating the session ID during the key exchange (KEX) process (bsc#1246974)
• CVE-2025-8277: Fixed Memory Exhaustion via Repeated Key Exchange (bsc#1249375)

This update for libssh fixes the following issues:

• CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX process is repeated with incorrect guesses (bsc#1249375).
• CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the KEX session ID (bsc#1246974).

This update for libssh fixes the following issues:

• CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX process is repeated with incorrect guesses (bsc#1249375).
• CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the KEX session ID (bsc#1246974).

This update for libssh fixes the following issues:

• CVE-2025-8114: Fixed a NULL pointer dereference when calculating session ID during KEX. (bsc#1246974)

This update for libssh fixes the following issues:

• Update to version 0.11.4:
• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
• CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
• CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)

This update for libssh fixes the following issues:

• Update to version 0.11.4:
• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
• CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
• CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)

Philippe Antoine discovered that libssh did not properly manage memory when calculating a session id during the key exchange process. An attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service.