{"id":"CVE-2025-5449","aliases":["ALPINE-CVE-2025-5449","BELL-CVE-2025-5449","DEBIAN-CVE-2025-5449","EUVD-2025-22738","GHSA-q9x7-4rf7-4xq2","JLSEC-2025-100","MGASA-2026-0189","UBUNTU-CVE-2025-5449","USN-7619-1","openSUSE-SU-2025:15243-1"],"status":"published","title":"Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01027,"percentile":0.63869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-06-25T00:00:00Z","modified":"2026-11-05T21:16:09Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.11.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libssh_jll","fixed_in":["0.11.3+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.1-r0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.1-r0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"libssh_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0+0"},{"fixed":"0.11.3+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1.1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.4"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.1"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.1"}]}],"bundled":7}],"products":[{"vendor":"libssh","product":"libssh"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-5449","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369705","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11\u0026id=261612179f740bc62ba363d98b3bd5e5573a811f","tags":["Patch","web"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11\u0026id=3443aec90188d6aab9282afc80a81df5ab72c4da","tags":["Patch","web"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11\u0026id=5504ff40515439a5fecbb17da7483000c4d12eb7","tags":["Patch","web"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11\u0026id=78485f446af9b30e37eb8f177b81940710d54496","tags":["Patch","web"]},{"url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11\u0026id=f79ec51b7fd519dbc5737a7ba826e3ed093f6ceb","tags":["Patch","web"]},{"url":"https://www.libssh.org/security/advisories/CVE-2025-5449.txt","tags":["Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5449","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q9x7-4rf7-4xq2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-5449","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-5449","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://www.libssh.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5449.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-5449","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0189.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34405","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/27/2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-5449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5449","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7619-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5987","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5987","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-5449","title":"Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T17:19:39.345Z","modified":"2026-11-05T15:37:06.104Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-22738","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T17:19:39Z","modified":"2026-11-05T15:37:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T18:00:59.460287Z"}],"ghsa":[{"id":"GHSA-q9x7-4rf7-4xq2","title":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an...","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T18:30:41Z","modified":"2025-07-25T18:30:52Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:03:07.428711Z"}],"nvd":[{"id":"CVE-2025-5449","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T18:15:26.967Z","modified":"2026-11-05T16:17:21.917Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"ALPINE-CVE-2025-5449","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T18:15:26.967Z","modified":"2026-11-03T06:33:00.749458449Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2025-5449","status":"published","published":"2025-06-28T06:01:49.424553Z","modified":"2026-01-26T09:40:32.936043Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-5449","title":"Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T17:19:39.345Z","modified":"2026-11-07T02:30:33.046333805Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T03:07:57.488512Z"},{"id":"DEBIAN-CVE-2025-5449","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-07-25T18:15:26.967Z","modified":"2026-09-01T20:05:54.503399325Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2025-100","title":"A flaw was found in the SFTP server message decoding logic of libssh","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"published","published":"2025-10-19T18:40:48.457Z","modified":"2026-07-18T00:00:06.373478312Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2025-5449","description":"A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.","status":"withdrawn","published":"2025-06-25T00:00:00Z","modified":"2026-02-04T02:36:48.77222Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"MGASA-2026-0189","title":"Updated libssh packages fix security vulnerabilities","description":"CVE-2025-4877  Write beyond bounds in binary to base64 conversion\nfunctions\nCVE-2025-4878  Use of uninitialized variable in privatekey_from_file()\nCVE-2025-5318  Likely read beyond bounds in sftp server handle\nmanagement\nCVE-2025-5351  Double free in functions exporting keys\nCVE-2025-5372  ssh_kdf() returns a success code on certain failures\nCVE-2025-5449  Likely read beyond bounds in sftp server message decoding\nCVE-2025-5987  Invalid return code for chacha20 poly1305 with OpenSSL\nbackend\n","status":"published","published":"2026-06-10T05:07:06Z","modified":"2026-06-10T05:15:04.434517705Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15243-1","title":"libssh-config-0.11.2-1.1 on GA media","description":"These are all security issues fixed in the libssh-config-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.579146Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"USN-7619-1","title":"libssh vulnerabilities","description":"Ronald Crane discovered that libssh incorrectly handled certain base64\nconversions. An attacker could use this issue to cause libssh to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-4877)\n\nRonald Crane discovered that libssh incorrectly handled the\nprivatekey_from_file() function. An attacker could use this issue to cause\nlibssh to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2025-4878)\n\nRonald Crane discovered that libssh incorrectly handled certain memory\noperations in the sftp server. An attacker could possibly use this issue\nto cause libssh to crash, resulting in a denial of service.\n(CVE-2025-5318, CVE-2025-5449)\n\nRonald Crane discovered that libssh incorrectly handled exporting keys. An\nattacker could possibly use this issue to cause libssh to crash, resulting\nin a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu\n24.10, and Ubuntu 25.04. (CVE-2025-5351)\n\nRonald Crane discovered that libssh incorrectly handled the ssh_kdf()\nfunction. An attacker could use this issue to cause libssh to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-5372)\n\nRonald Crane discovered that libssh incorrectly handled the ChaCha20\ncipher. An attacker could possibly use this issue to cause libssh to\nuse partially initialized cypher content. This issue only affected Ubuntu\n24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-5987)","status":"published","published":"2025-07-07T12:29:26Z","modified":"2026-10-27T04:16:21.150937013Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}