{"id":"CVE-2025-4878","aliases":["ALPINE-CVE-2025-4878","ALSA-2026:18683","AZL-65643","AZL-65646","BELL-CVE-2025-4878","CLSA-2026-1779467653","CLSA-2026-1787056678","DEBIAN-CVE-2025-4878","DLA-4385-1","EUVD-2025-22335","GHSA-q2fw-m52x-w593","MGASA-2026-0189","OESA-2025-2127","OESA-2025-2128","OESA-2025-2129","OESA-2025-2130","OESA-2025-2132","OESA-2025-2294","RHSA-2026:18683","RLSA-2026:18683","SUSE-SU-2025:02229-1","SUSE-SU-2025:02278-1","SUSE-SU-2025:02279-1","SUSE-SU-2025:02281-1","SUSE-SU-2025:02755-1","SUSE-SU-2025:20557-1","SUSE-SU-2025:20596-1","UBUNTU-CVE-2025-4878","USN-7619-1","USN-7696-1","openSUSE-SU-2025:15243-1"],"status":"published","title":"Libssh: use of uninitialized variable in privatekey_from_file()","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00228,"percentile":0.13625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-06-25T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libssh","fixed_in":["0.10.6-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libssh","fixed_in":["0.10.6-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh","fixed_in":["0.10.6-0+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","fixed_in":["0.6.3-4.3ubuntu0.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","fixed_in":["0.9.3-2ubuntu2.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libssh","fixed_in":["0.9.6-2ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libssh","fixed_in":["0.10.6-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Azure Linux:2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.4-r0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.1-r0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.6-r1"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-15.el9_6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-15.el9_6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-15.el9_6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-0+deb12u2"}]}],"versions":["0.10.5-2","0.10.5-3","0.10.5-3+hurd.1","0.10.6-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-0+deb11u2"}]}],"versions":["0.9.5-1","0.9.5-1+deb11u1","0.9.6-1","0.9.6-2","0.9.7-0+deb11u1","0.9.8-0+deb11u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1.1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-5.oe2403sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-11.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-11.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-11.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-5.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-5.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-18.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-12.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-12.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-slfo.1.1_2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+esm2"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6","0.6.3-4.3ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+esm1"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4","0.9.3-2ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.4"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.1"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.4"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.1"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+esm2"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6","0.6.3-4.3ubuntu0.6+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+esm1"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4","0.9.3-2ubuntu2.5"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.1"}]}],"bundled":7}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:18683","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-4878","tags":["vdb-entry","x_refsource_REDHAT","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2376184","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1","tags":["web","article"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb","tags":["web","article"]},{"url":"https://www.libssh.org/security/advisories/CVE-2025-4878.txt","tags":["article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4878","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q2fw-m52x-w593"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-4878","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-4877","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5351","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-8114","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-8277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0964","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0965","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0966","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0967","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0968","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369367","tags":["report"]},{"url":"https://bugzilla.redhat.com/2376184","tags":["report"]},{"url":"https://bugzilla.redhat.com/2376193","tags":["report"]},{"url":"https://bugzilla.redhat.com/2383220","tags":["report"]},{"url":"https://bugzilla.redhat.com/2383888","tags":["report"]},{"url":"https://bugzilla.redhat.com/2433121","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436979","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436980","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436981","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436982","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-18683.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-4878","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779467653.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787056678.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59846","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-4878","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0189.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34405","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/27/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5372","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5987","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2128","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2129","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2130","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2132","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2294","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2376193","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2383220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2383888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436981","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436982","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-150661","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18683.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4877","tags":["advisory"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11\u0026id=6fd9cc8ce3958092a1aae11f1f2e911b2747732d","tags":["article"]},{"url":"https://www.libssh.org/security/advisories/CVE-2025-4877.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4878","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5351","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8114","tags":["advisory"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d","tags":["article"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9","tags":["article"]},{"url":"https://www.libssh.org/security/advisories/CVE-2025-8114.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8277","tags":["advisory"]},{"url":"https://www.libssh.org/security/advisories/CVE-2025-8277.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0964","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0964","tags":["advisory"]},{"url":"https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0965","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0966","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0967","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0968","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18683","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502229-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245309","tags":["report"]},{"url":"https://bugzilla.suse.com/1245310","tags":["report"]},{"url":"https://bugzilla.suse.com/1245311","tags":["report"]},{"url":"https://bugzilla.suse.com/1245314","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5372","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502278-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502279-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502281-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502755-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520557-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245312","tags":["report"]},{"url":"https://bugzilla.suse.com/1245317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5987","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520596-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4878","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7619-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7696-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5987","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5449","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-4878","title":"Libssh: use of uninitialized variable in privatekey_from_file()","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T14:17:03.122Z","modified":"2026-11-06T17:43:53.938Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2025-22335","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T14:17:03Z","modified":"2026-11-06T17:43:53Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T19:05:53.354277Z"}],"ghsa":[{"id":"GHSA-q2fw-m52x-w593","title":"A vulnerability was found in libssh, where an uninitialized variable exists under certain...","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:32:52Z","modified":"2026-05-19T15:31:19Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:08:12.004262Z"}],"nvd":[{"id":"CVE-2025-4878","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:15:36.307Z","modified":"2026-11-06T18:17:21.063Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-06T20:01:10.091781Z"}],"osv":[{"id":"ALPINE-CVE-2025-4878","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:15:36.307Z","modified":"2026-11-03T06:32:15.422109292Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2025-4878","status":"published","published":"2025-06-28T06:01:49.169968Z","modified":"2026-01-26T09:40:29.270819Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"DEBIAN-CVE-2025-4878","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:15:36.307Z","modified":"2026-11-07T09:47:33.351405734Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2025-2127","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as critical was found in libssh up to 0.11.1.The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4877)\n\nA vulnerability, which was classified as problematic, has been found in libssh up to 0.11.1.Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized.Impacted is confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4878)\n\nA flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.(CVE-2025-5351)\n\nA flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions\u0026apos; confidentiality, integrity, and availability.(CVE-2025-5372)\n\nA flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.(CVE-2025-5987)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:09.479190712Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2128","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as critical was found in libssh up to 0.11.1.The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4877)\n\nA vulnerability, which was classified as problematic, has been found in libssh up to 0.11.1.Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized.Impacted is confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4878)\n\nA flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions\u0026apos; confidentiality, integrity, and availability.(CVE-2025-5372)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:09.302023336Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2129","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as critical was found in libssh up to 0.11.1.The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4877)\n\nA vulnerability, which was classified as problematic, has been found in libssh up to 0.11.1.Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized.Impacted is confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4878)\n\nA flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions\u0026apos; confidentiality, integrity, and availability.(CVE-2025-5372)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:09.345366643Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2130","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as critical was found in libssh up to 0.11.1.The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4877)\n\nA vulnerability, which was classified as problematic, has been found in libssh up to 0.11.1.Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized.Impacted is confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4878)\n\nA flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions\u0026apos; confidentiality, integrity, and availability.(CVE-2025-5372)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:09.302919668Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2132","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as critical was found in libssh up to 0.11.1.The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4877)\n\nA vulnerability, which was classified as problematic, has been found in libssh up to 0.11.1.Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized.Impacted is confidentiality, integrity, and availability.Upgrading to version 0.11.2 eliminates this vulnerability.(CVE-2025-4878)\n\nA flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.(CVE-2025-5351)\n\nA flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions\u0026apos; confidentiality, integrity, and availability.(CVE-2025-5372)\n\nA flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.(CVE-2025-5987)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:09.457361588Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2294","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\nThere\u0026apos;s a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it\u0026apos;s possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.(CVE-2025-4877)\n\nA vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn\u0026apos;t exist and may lead to possible signing failures or heap corruption.(CVE-2025-4878)\n\nA flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.(CVE-2025-5351)\n\nA flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions\u0026apos; confidentiality, integrity, and availability.(CVE-2025-5372)","status":"published","published":"2025-09-12T11:09:22Z","modified":"2026-08-18T01:19:10.392577763Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2026:18683","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2026-05-20T10:09:25Z","modified":"2026-10-17T10:10:05Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RLSA-2026:18683","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)\n\n* libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)\n\n* libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)\n\n* libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)\n\n* libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)\n\n* libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)\n\n* libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)\n\n* libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)\n\n* libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)\n\n* libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:22.703988412Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-4878","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-06-25T00:00:00Z","modified":"2026-04-22T16:04:09.292037Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"ALSA-2026:18683","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  \n\nSecurity Fix(es):  \n\n  * libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)\n  * libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)\n  * libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)\n  * libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)\n  * libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)\n  * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)\n  * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)\n  * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)\n  * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)\n  * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:31.079999242Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-65643","title":"CVE-2025-4878 affecting package libssh for versions less than 0.10.6-3","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:15:36Z","modified":"2026-04-21T04:37:39.344411Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65646","title":"CVE-2025-4878 affecting package libssh for versions less than 0.10.6-3","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:15:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"CLSA-2026-1779467653","title":"libssh: Fix of 4 CVEs","description":"- CVE-2025-4877: prevent base64 integer overflow and potential OOB write\n- CVE-2025-4878: initialize stack pointers to mitigate use of uninitialized\n  values in legacy privatekey_from_file() path\n- CVE-2025-8277: fix DH-GEX packet filter and free unused ephemeral / ECDH\n  keys to prevent memory exhaustion\n- CVE-2026-0965: skip non-regular and oversized configuration / known_hosts\n  files to avoid local DoS","status":"published","published":"2026-05-22T16:34:17Z","modified":"2026-06-01T00:32:54.653217115Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1787056678","title":"libssh: Fix of 2 CVEs","description":"- CVE-2025-4878: initialize pointers and properly check the return value\n  of ssh_pki_import_privkey_file() in privatekey_from_file(), so a missing\n  key file no longer leaves an uninitialized key in use\n- CVE-2026-59846: validate usernames and reject shell metacharacters before\n  they are expanded into a shell-evaluated ProxyCommand","status":"published","published":"2026-08-18T12:38:09Z","modified":"2026-10-26T09:30:31.730554291Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CVE-2025-4878","description":"A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.","status":"published","published":"2025-07-22T15:15:36Z","modified":"2026-05-26T16:14:21.850983507Z","updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DLA-4385-1","title":"libssh - security update","status":"published","published":"2025-11-27T00:00:00Z","modified":"2025-11-27T10:18:25.20627Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2026-0189","title":"Updated libssh packages fix security vulnerabilities","description":"CVE-2025-4877  Write beyond bounds in binary to base64 conversion\nfunctions\nCVE-2025-4878  Use of uninitialized variable in privatekey_from_file()\nCVE-2025-5318  Likely read beyond bounds in sftp server handle\nmanagement\nCVE-2025-5351  Double free in functions exporting keys\nCVE-2025-5372  ssh_kdf() returns a success code on certain failures\nCVE-2025-5449  Likely read beyond bounds in sftp server message decoding\nCVE-2025-5987  Invalid return code for chacha20 poly1305 with OpenSSL\nbackend\n","status":"published","published":"2026-06-10T05:07:06Z","modified":"2026-06-10T05:15:04.434517705Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15243-1","title":"libssh-config-0.11.2-1.1 on GA media","description":"These are all security issues fixed in the libssh-config-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.579146Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:02229-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-5318: Fixed likely read beyond bounds in sftp server handle management (bsc#1245311).\n- CVE-2025-4877: Fixed write beyond bounds in binary to base64 conversion functions (bsc#1245309).\n- CVE-2025-4878: Fixed use of uninitialized variable in privatekey_from_file() (bsc#1245310).\n- CVE-2025-5372: Fixed cases where ssh_kdf() returns a success code on certain failures (bsc#1245314).\n","status":"published","published":"2025-07-04T16:02:31Z","modified":"2026-03-23T04:46:28.857915Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02278-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-4877: Fixed write beyond bounds in binary to base64 conversion functions (bsc#1245309).\n- CVE-2025-4878: Fixed use of uninitialized variable in privatekey_from_file() (bsc#1245310).\n- CVE-2025-5318: Fixed likely read beyond bounds in sftp server handle management (bsc#1245311).\n- CVE-2025-5372: Fixed ssh_kdf() returns a success code on certain failures (bsc#1245314).\n","status":"published","published":"2025-07-10T16:02:57Z","modified":"2026-03-23T04:44:47.287373Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02279-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-4877: Fixed write beyond bounds in binary to base64 conversion functions (bsc#1245309).\n- CVE-2025-4878: Fixed use of uninitialized variable in privatekey_from_file() (bsc#1245310).\n- CVE-2025-5318: Fixed likely read beyond bounds in sftp server handle management (bsc#1245311).\n- CVE-2025-5372: Fixed ssh_kdf() returns a success code on certain failures (bsc#1245314).\n","status":"published","published":"2025-07-10T16:03:25Z","modified":"2026-03-23T04:46:29.963745Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02281-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-4877: Fixed write beyond bounds in binary to base64 conversion functions (bsc#1245309).\n- CVE-2025-4878: Fixed use of uninitialized variable in privatekey_from_file() (bsc#1245310).\n- CVE-2025-5318: Fixed likely read beyond bounds in sftp server handle management (bsc#1245311).\n- CVE-2025-5372: Fixed ssh_kdf() returns a success code on certain failures (bsc#1245314).\n","status":"published","published":"2025-07-10T16:05:33Z","modified":"2026-03-23T04:48:32.934194Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02755-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-4877: Fixed write beyond bounds in binary to base64 conversion functions (bsc#1245309).\n- CVE-2025-4878: Fixed use of uninitialized variable in privatekey_from_file() (bsc#1245310).\n- CVE-2025-5318: Fixed likely read beyond bounds in sftp server handle management (bsc#1245311).\n","status":"published","published":"2025-08-12T07:35:23Z","modified":"2026-02-04T03:28:40.873872Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20557-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)\n- CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend (bsc#1245317)\n- CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)\n- CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)\n- CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)\n- CVE-2025-5351: Double free in functions exporting keys (bsc#1245312)\n\n","status":"published","published":"2025-08-14T09:26:49Z","modified":"2026-03-23T04:47:16.538622Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20596-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)\n- CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend (bsc#1245317)\n- CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)\n- CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)\n- CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)\n- CVE-2025-5351: Double free in functions exporting keys (bsc#1245312)\n\n","status":"published","published":"2025-08-14T10:14:25Z","modified":"2026-03-23T04:50:52.646573Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-7619-1","title":"libssh vulnerabilities","description":"Ronald Crane discovered that libssh incorrectly handled certain base64\nconversions. An attacker could use this issue to cause libssh to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-4877)\n\nRonald Crane discovered that libssh incorrectly handled the\nprivatekey_from_file() function. An attacker could use this issue to cause\nlibssh to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2025-4878)\n\nRonald Crane discovered that libssh incorrectly handled certain memory\noperations in the sftp server. An attacker could possibly use this issue\nto cause libssh to crash, resulting in a denial of service.\n(CVE-2025-5318, CVE-2025-5449)\n\nRonald Crane discovered that libssh incorrectly handled exporting keys. An\nattacker could possibly use this issue to cause libssh to crash, resulting\nin a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu\n24.10, and Ubuntu 25.04. (CVE-2025-5351)\n\nRonald Crane discovered that libssh incorrectly handled the ssh_kdf()\nfunction. An attacker could use this issue to cause libssh to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-5372)\n\nRonald Crane discovered that libssh incorrectly handled the ChaCha20\ncipher. An attacker could possibly use this issue to cause libssh to\nuse partially initialized cypher content. This issue only affected Ubuntu\n24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-5987)","status":"published","published":"2025-07-07T12:29:26Z","modified":"2026-10-27T04:16:21.150937013Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7696-1","title":"libssh vulnerabilities","description":"Ronald Crane discovered that libssh incorrectly handled certain base64\nconversions. An attacker could use this issue to cause libssh to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-4877)\n\nRonald Crane discovered that libssh incorrectly handled the\nprivatekey_from_file() function. An attacker could use this issue to cause\nlibssh to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2025-4878)\n\nRonald Crane discovered that libssh incorrectly handled certain memory\noperations in the sftp server. An attacker could possibly use this issue\nto cause libssh to crash, resulting in a denial of service.\n(CVE-2025-5318)","status":"published","published":"2025-08-14T06:35:13Z","modified":"2026-10-27T04:16:31.131352896Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}