Summary
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
* libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)
* libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)
* libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)
* libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)
* libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)
* libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
* libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
* libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
* libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
* libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | libssh | 0:0.10.4-18.el9 |
Vulnerabilities 10
-
Medium 6.5
Libssh: double free vulnerability in libssh key export functions
A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a poten…
-
Medium 6.5
Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authenti…
-
Medium 5.0
Libssh: improper sanitation of paths received from scp servers
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specifi…
-
Medium 4.7
Libssh: null pointer dereference in libssh kex session id calculation
A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the cl…
-
Medium 4.5
Libssh: write beyond bounds in binary to base64 conversion functions
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory u…
-
Low 3.6
Libssh: use of uninitialized variable in privatekey_from_file()
A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failur…
-
Low 3.3
Libssh: libssh: denial of service via improper configuration file handling
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial …
-
Low 3.1
Libssh: memory exhaustion via repeated key exchange in libssh
A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crash…
-
Low 3.1
Libssh: libssh: denial of service due to malformed sftp message
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading bey…
-
Low 2.2
Libssh: libssh: denial of service via inefficient regular expression processing
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This c…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2369367
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2376184
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2376193
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2383220
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2383888
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2433121
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2436979
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2436980
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2436981
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2436982