CVE-2025-5449
published 2025-07-25CVE-2025-5449: A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.78%
51.7th percentile
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libssh | < libssh 0.11.2-1 (forky) | libssh 0.11.2-1 (forky) |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | >= 0 < 0.11.2-1 | 0.11.2-1 |
| libssh | libssh | >= 0 < 0.11.2-1 | 0.11.2-1 |
| libssh | libssh | >= 0 < 0.9.6-2ubuntu0.22.04.4 | 0.9.6-2ubuntu0.22.04.4 |
| libssh | libssh | >= 0 < 0.10.6-2ubuntu0.1 | 0.10.6-2ubuntu0.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
vendor_ubuntu4.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q9x7-4rf7-4xq2: A flaw was found in the SFTP server message decoding logic of libssh
ghsa_unreviewed·2025-07-25
CVE-2025-5449 [MEDIUM] CWE-190 GHSA-q9x7-4rf7-4xq2: A flaw was found in the SFTP server message decoding logic of libssh
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
OSV
CVE-2025-5449: A flaw was found in the SFTP server message decoding logic of libssh
osv·2025-07-25·CVSS 6.5
CVE-2025-5449 [MEDIUM] CVE-2025-5449: A flaw was found in the SFTP server message decoding logic of libssh
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
OSV
libssh vulnerabilities
osv·2025-07-07·CVSS 4.5
CVE-2025-4877 [MEDIUM] libssh vulnerabilities
libssh vulnerabilities
Ronald Crane discovered that libssh incorrectly handled certain base64
conversions. An attacker could use this issue to cause libssh to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2025-4877)
Ronald Crane discovered that libssh incorrectly handled the
privatekey_from_file() function. An attacker could use this issue to cause
libssh to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2025-4878)
Ronald Crane discovered that libssh incorrectly handled certain memory
operations in the sftp server. An attacker could possibly use this issue
to cause libssh to crash, resulting in a denial of service.
(CVE-2025-5318, CVE-2025-5449)
Ronald Crane discovered that libssh incorrectly handled exporting keys.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2025-07-07·CVSS 4.5
CVE-2025-5351 [MEDIUM] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
Ronald Crane discovered that libssh incorrectly handled certain base64
conversions. An attacker could use this issue to cause libssh to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2025-4877)
Ronald Crane discovered that libssh incorrectly handled the
privatekey_from_file() function. An attacker could use this issue to cause
libssh to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2025-4878)
Ronald Crane discovered that libssh incorrectly handled certain memory
operations in the sftp server. An attacker could possibly use this issue
to cause libssh to crash, resulting in a denial of service.
(CVE-2025-5318, CVE-2025-5449)
Ronald C
Red Hat
libssh: Integer Overflow in libssh SFTP Server Packet Length Validation Leading to Denial of Service
vendor_redhat·2025-06-24·CVSS 6.5
CVE-2025-5449 [MEDIUM] CWE-190 libssh: Integer Overflow in libssh SFTP Server Packet Length Validation Leading to Denial of Service
libssh: Integer Overflow in libssh SFTP Server Packet Length Validation Leading to Denial of Service
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Statement: The Red Hat Product Sec
Debian
CVE-2025-5449: libssh - A flaw was found in the SFTP server message decoding logic of libssh. The issue ...
vendor_debian·2025·CVSS 6.5
CVE-2025-5449 [MEDIUM] CVE-2025-5449: libssh - A flaw was found in the SFTP server message decoding logic of libssh. The issue ...
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 0.11.2-1)
sid: resolved (fixed in 0.11.2-1)
trixie: resolved (fixed in 0.11.2-1)
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/CVE-2025-5449https://bugzilla.redhat.com/show_bug.cgi?id=2369705https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811fhttps://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4dahttps://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=78485f446af9b30e37eb8f177b81940710d54496https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=f79ec51b7fd519dbc5737a7ba826e3ed093f6cebhttps://www.libssh.org/security/advisories/CVE-2025-5449.txt
2025-07-25
Published