Description
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libssh | < 0.11.2 | 0.11.2 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat OpenShift distributed tracing 3.7.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libssh | 0.11.2-1 | — |
| Debian 13 | libssh | 0.11.2-1 | — |
| Debian 12 | libssh | 0.10.6-0+deb12u2 | — |
| Debian 11 | libssh | 0.9.8-0+deb11u2 | DLA-4385-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libssh | 0.10.6-2ubuntu0.1 | USN-7619-1 |
| Ubuntu 22.04 LTS | libssh | 0.9.6-2ubuntu0.22.04.4 | USN-7619-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libssh | 0.9.3-2ubuntu2.5+esm1 | USN-7696-1 |
| Ubuntu Pro 18.04 LTS | libssh | 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4 | USN-7696-1 |
| Ubuntu Pro 16.04 LTS | libssh | 0.6.3-4.3ubuntu0.6+esm2 | USN-7696-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libssh +2 | 0.11.1-4.el10_0 | RHSA-2025:21013, RHSA-2025:18231 |
| RHEL 9 | libssh +2 | 0.10.4-15.el9_6 | RHSA-2025:20943, RHSA-2025:18275 |
| RHEL 8 | libssh +2 | 0.9.6-15.el8_10 | RHSA-2025:18286 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | libssh +2 | 0.10.4-13.el9_4.1 | RHSA-2025:19012 |
| RHEL 9.2 E4S | libssh +2 | 0.10.4-9.el9_2.1 | RHSA-2025:19470 |
| RHEL 9.0 E4S | libssh +2 | 0.9.6-3.el9_0.1 | RHSA-2025:19472 |
| RHEL 8.8 TUS | libssh +2 | 0.9.6-13.el8_8.1 | RHSA-2025:19101 |
| RHEL 8.8 E4S | libssh +2 | 0.9.6-13.el8_8.1 | RHSA-2025:19101 |
| RHEL 8.6 TUS | libssh +2 | 0.9.6-4.el8_6.1 | RHSA-2025:19098 |
| RHEL 8.6 E4S | libssh +2 | 0.9.6-4.el8_6.1 | RHSA-2025:19098 |
| RHEL 8.6 AUS | libssh +2 | 0.9.6-4.el8_6.1 | RHSA-2025:19098 |
| RHEL 8.4 EUS Long Life | libssh +2 | 0.9.4-2.el8_4.1 | RHSA-2025:19401 |
| RHEL 8.4 AUS | libssh +2 | 0.9.4-2.el8_4.1 | RHSA-2025:19401 |
| RHEL 8.2 AUS | libssh +2 | 0.9.0-4.el8_2.1 | RHSA-2025:19400 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libssh +1 | 0.11.1-4.el10_1 | ALSA-2025:21013 |
| AlmaLinux 10 | libssh-config | 0.11.1-4.el10_0 | ALSA-2025:21013, ALSA-2025:18231 |
| AlmaLinux 9 | libssh +2 | 0.10.4-15.el9_6 | ALSA-2025:20943, ALSA-2025:18275 |
| AlmaLinux 8 | libssh +2 | 0.9.6-15.el8_10 | ALSA-2025:18286 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libssh | 0.11.1-4.el10_0 | RLSA-2025:18231 |
| Rocky Linux 9 | libssh | 0.10.4-15.el9_6 | RLSA-2025:20943, RLSA-2025:18275 |
| Rocky Linux 8 | libssh | 0.9.6-15.el8_10 | RLSA-2025:18286 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libssh | 0.9.8-150600.11.3.1 | SUSE-SU-2025:02229-1 |
| SLES 15 SP6 | libssh | 0.9.8-150600.11.3.1 | SUSE-SU-2025:02229-1 |
| SLES 15 SP5 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLES 15 SP4 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLES 15 SP3 | libssh | 0.9.8-150200.13.9.1 | SUSE-SU-2025:02279-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | libssh | 0.6.3-12.15.1 | SUSE-SU-2025:02755-1, SUSE-SU-2025:02281-1 |
| SLES for SAP 15 SP5 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLES for SAP 15 SP4 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLES for SAP 15 SP3 | libssh | 0.9.8-150200.13.9.1 | SUSE-SU-2025:02279-1 |
| SLE Micro 6.1 | libssh | 0.10.6-slfo.1.1_2.1 | SUSE-SU-2025:20596-1 |
| SLE Micro 6.0 | libssh | 0.10.6-2.1 | SUSE-SU-2025:20557-1 |
| SLE Micro 5.5 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLE Micro 5.4 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLE Micro 5.3 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLE Micro 5.2 | libssh | 0.9.8-150200.13.9.1 | SUSE-SU-2025:02279-1 |
| SLE Micro 5.1 | libssh | 0.9.8-150200.13.9.1 | SUSE-SU-2025:02279-1 |
| SLE HPC 15 SP5 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLE HPC 15 SP4 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SLE HPC 15 SP3 | libssh | 0.9.8-150200.13.9.1 | SUSE-SU-2025:02279-1 |
| SUSE Manager Server 4.3 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SUSE Manager Proxy 4.3 | libssh | 0.9.8-150400.3.9.1 | SUSE-SU-2025:02278-1 |
| SUSE Enterprise Storage 7.1 | libssh | 0.9.8-150200.13.9.1 | SUSE-SU-2025:02279-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libssh | 0.11.2-1.1 | openSUSE-SU-2025:15243-1 |
| openSUSE Leap 15.6 | libssh | 0.9.8-150600.11.3.1 | SUSE-SU-2025:02229-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libssh | 0.11.2-r0 | — |
| Alpine v3.23 | libssh | 0.11.2-r0 | — |
| Alpine v3.22 | libssh | 0.11.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libssh +2 | 0.10.6-1.amzn2023.0.2 | ALAS2023-2025-1155 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libssh | 0.10.6-2 | — |
| Azure Linux 2 (CBL-Mariner) | libssh | 0.10.6-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libssh +2 | 0.11.1-4.el10_0 | ELSA-2025-21013, ELSA-2025-18231 |
| Oracle Linux 9 | libssh +2 | 0.10.4-15.el9_6 | ELSA-2025-20943, ELSA-2025-18275 |
| Oracle Linux 8 | libssh +2 | 0.9.6-15.el8_10 | ELSA-2025-18286 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | libssh | 0.11.3-r0 | — |
| Wolfi rolling | libssh2 | 1.11.1-r1 | — |
Advisories 50
- WID-SEC-2026-1199 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2025:21013 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:20943 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:18275 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:18231 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:18286 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-7696-1 libssh vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-7619-1 libssh vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- WID-SEC-2025-1423 libssh: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
- WID-SEC-2025-1385 libssh: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 13, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- RHSA-2025:21013 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:20943 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19472 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19470 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19400 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19401 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19101 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19012 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:19098 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:18286 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:18231 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2025:18275 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- WID-SEC-2026-1118 Dell PowerProtect Data Domain OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 5, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- openSUSE-SU-2025:15243-1 libssh-config-0.11.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20596-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02281-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20557-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02279-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02229-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02278-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02755-1 Security update for libssh SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2363 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 3, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- ELSA-2025-21013 Moderate: libssh security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- RLSA-2025:18286 Moderate: libssh security update Rocky Linux Security Advisories · Nov 28, 2025
- DLA-4385-1 libssh - security update Debian Security (DSA / DLA) · Nov 27, 2025
- ELSA-2025-20943 Moderate: libssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- RLSA-2025:20943 Moderate: libssh security update Rocky Linux Security Advisories · Nov 12, 2025
- NCSC-2025-0339 Kwetsbaarheden verholpen in Oracle MySQL NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- ELSA-2025-18286 Moderate: libssh security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 19, 2025
- RLSA-2025:18275 Moderate: libssh security update Rocky Linux Security Advisories · Oct 18, 2025
- RLSA-2025:18231 Moderate: libssh security update Rocky Linux Security Advisories · Oct 18, 2025
- ELSA-2025-18231 Moderate: libssh security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
- ELSA-2025-18275 Moderate: libssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
References
- RHSA-2025:18231 vendor-advisory
- RHSA-2025:18275 vendor-advisory
- RHSA-2025:18286 vendor-advisory
- RHSA-2025:19012 vendor-advisory
- RHSA-2025:19098 vendor-advisory
- RHSA-2025:19101 vendor-advisory
- RHSA-2025:19295 vendor-advisory
- RHSA-2025:19300 vendor-advisory
- RHSA-2025:19313 vendor-advisory
- RHSA-2025:19400 vendor-advisory
- RHSA-2025:19401 vendor-advisory
- RHSA-2025:19470 vendor-advisory
- RHSA-2025:19472 vendor-advisory
- RHSA-2025:19807 vendor-advisory
- RHSA-2025:19864 vendor-advisory
- RHSA-2025:20943 vendor-advisory
- RHSA-2025:21013 vendor-advisory
- RHSA-2025:21329 vendor-advisory
- RHSA-2025:21829 vendor-advisory
- RHSA-2025:22275 vendor-advisory
- RHSA-2025:23078 vendor-advisory
- RHSA-2025:23079 vendor-advisory
- RHSA-2025:23080 vendor-advisory
- RHSA-2026:0326 vendor-advisory
- RHSA-2026:1541 vendor-advisory
- RHSA-2026:3461 vendor-advisory
- RHSA-2026:3462 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-5318 vdb-entry
- RHBZ#2369131 issue-tracking
- https://www.libssh.org/security/advisories/CVE-2025-5318.txt