Red Hat Security Advisory: libssh security update

Fixed packages 1

Vulnerabilities 1

• High 8.1
  CVE-2025-5987

  Libssh: invalid return code for chacha20 poly1305 with openssl backend

  A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenS…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 7, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376219
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0430.json
• report
  https://access.redhat.com/security/cve/CVE-2025-5987
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-5987
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-5987
• article
  https://www.libssh.org/security/advisories/CVE-2025-5987.txt