Description
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libssh | 0.10.0 – < 0.11.2 | 0.11.2 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libssh | 0.11.2-1 | — |
| Debian 13 | libssh | 0.11.2-1 | — |
| Debian 12 | libssh | 0.10.6-0+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libssh | 0.10.6-2ubuntu0.1 | USN-7619-1 |
| Ubuntu 22.04 LTS | libssh | 0.9.6-2ubuntu0.22.04.4 | USN-7619-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libssh +2 | 0.11.1-5.el10_1 | RHSA-2025:23484 |
| RHEL 9 | libssh +2 | 0.10.4-17.el9_7 | RHSA-2025:23483 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libssh | 0.11.1-4.el10_0.1 | RHSA-2026:0427 |
| RHEL 9.6 EUS | libssh | 0.10.4-15.el9_6.1 | RHSA-2026:0428 |
| RHEL 9.4 EUS | libssh | 0.10.4-13.el9_4.2 | RHSA-2026:0431 |
| RHEL 9.2 E4S | libssh | 0.10.4-9.el9_2.2 | RHSA-2026:0430 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libssh-config | 0.11.1-5.el10_1 | ALSA-2025:23484 |
| AlmaLinux 9 | libssh +2 | 0.10.4-17.el9_7 | ALSA-2025:23483 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libssh | 0.11.1-5.el10_1 | RLSA-2025:23484 |
| Rocky Linux 9 | libssh | 0.10.4-17.el9_7 | RLSA-2025:23483 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libssh | 0.10.6-slfo.1.1_2.1 | SUSE-SU-2025:20596-1 |
| SLE Micro 6.0 | libssh | 0.10.6-2.1 | SUSE-SU-2025:20557-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libssh | 0.11.2-1.1 | openSUSE-SU-2025:15243-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libssh | 0.11.2-r0 | — |
| Alpine v3.23 | libssh | 0.11.2-r0 | — |
| Alpine v3.22 | libssh | 0.11.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libssh +2 | 0.10.6-1.amzn2023.0.2 | ALAS2023-2025-1155 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libssh | 0.10.6-2 | — |
| Azure Linux 2 (CBL-Mariner) | libssh | 0.10.6-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libssh +2 | 0.11.1-5.el10_1 | ELSA-2025-23484 |
| Oracle Linux 9 | libssh +2 | 0.10.4-17.el9_7 | ELSA-2025-23483 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | libssh | 0.11.3-r0 | — |
| Wolfi rolling | libssh2 | 1.11.1-r1 | — |
Advisories 20
- ALSA-2025:23483 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23484 Moderate: libssh security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-7619-1 libssh vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2026:0428 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:0430 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:0431 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:0427 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:23484 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:23483 Red Hat Security Advisory: libssh security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2025-1423 libssh: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
- openSUSE-SU-2025:15243-1 libssh-config-0.11.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20596-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20557-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 23, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- RLSA-2025:23483 Moderate: libssh security update Rocky Linux Security Advisories · Dec 19, 2025
- RLSA-2025:23484 Moderate: libssh security update Rocky Linux Security Advisories · Dec 18, 2025
- ELSA-2025-23483 Moderate: libssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 18, 2025
- ELSA-2025-23484 Moderate: libssh security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 17, 2025
- ALAS2023-2025-1155 Moderate: libssh security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 8, 2025
References
- RHSA-2025:23483 vendor-advisory
- RHSA-2025:23484 vendor-advisory
- RHSA-2026:0427 vendor-advisory
- RHSA-2026:0428 vendor-advisory
- RHSA-2026:0430 vendor-advisory
- RHSA-2026:0431 vendor-advisory
- RHSA-2026:0702 vendor-advisory
- RHSA-2026:0978 vendor-advisory
- RHSA-2026:0980 vendor-advisory
- RHSA-2026:0985 vendor-advisory
- RHSA-2026:0996 vendor-advisory
- RHSA-2026:1539 vendor-advisory
- RHSA-2026:1541 vendor-advisory
- RHSA-2026:3415 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-5987 vdb-entry
- RHBZ#2376219 issue-tracking
- https://www.libssh.org/security/advisories/CVE-2025-5987.txt