Description
Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libssh | 0.6.3-4 | — |
| Debian 13 | libssh | 0.6.3-4 | — |
| Debian 12 | libssh | 0.6.3-4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libssh | 0.6.1-0ubuntu3.1 | USN-2478-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libssh | 0.7.2-2.1 | openSUSE-SU-2024:10036-1 |
Advisories 3
- USN-2478-1 libssh vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10036-1 libssh-devel-0.7.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1056 libssh: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 7, 2024
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1158089
- USN-2478-1 vendor-advisory
- GLSA-201606-12 vendor-advisory
- FEDORA-2014-17324 vendor-advisory
- DSA-3488 vendor-advisory
- FEDORA-2014-17303 vendor-advisory
- http://www.libssh.org/2014/12/19/libssh-0-6-4-security-and-bugfix-release/
- http://advisories.mageia.org/MGASA-2015-0014.html
- 60838 third-party-advisory
- MDVSA-2015:020 vendor-advisory
- openSUSE-SU-2015:0017 vendor-advisory
- FEDORA-2014-17354 vendor-advisory