Skip to content
OpenAdvisories
Medium · 4.7 CVE-2025-8114 EUVD-2025-22513GHSA-fpr2-pgq7-qwg4

Libssh: null pointer dereference in libssh kex session id calculation

Published Jul 24, 2025 · Updated Nov 5, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Enterprise Linux 10 Product: Red Hat Enterprise Linux 6 Product: Red Hat Enterprise Linux 7 Product: Red Hat Enterprise Linux 8 Product: Red Hat Enterprise Linux 9 Product: Red Hat OpenShift Container Platform 4 Package: libssh Package: libssh Package: libssh Package: libssh Package: libssh-dev Platform: Linux Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

Affected products

VendorProductAffectedFixed
— libssh < 0.11.3 0.11.3
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat OpenShift Container Platform 4 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libssh 0.11.3-1 —
Debian 13 libssh 0.11.2-1+deb13u1 —
Debian 12 libssh 0.10.6-0+deb12u2 —
Debian 11 libssh 0.9.8-0+deb11u2 DLA-4385-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libssh 0.11.2-1ubuntu0.1 USN-7849-1
Ubuntu 24.04 LTS libssh 0.10.6-2ubuntu0.2 USN-7849-1
Ubuntu 22.04 LTS libssh 0.9.6-2ubuntu0.22.04.5 USN-7849-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libssh 0.9.3-2ubuntu2.5+esm2 USN-7849-1
Ubuntu Pro 18.04 LTS libssh 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm5 USN-7849-1
Ubuntu Pro 16.04 LTS libssh 0.6.3-4.3ubuntu0.6+esm3 USN-7849-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 libssh +2 0.10.4-18.el9 RHSA-2026:18683

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 libssh +2 0.10.4-18.el9 ALSA-2026:18683

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 libssh 0.10.4-18.el9 RLSA-2026:18683

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 libssh 0.9.8-150600.11.6.1 SUSE-SU-2025:03369-1
SLES 15 SP6 libssh 0.9.8-150600.11.6.1 SUSE-SU-2025:03369-1
SLES 12 SP5 libssh 0.6.3-12.21.1 SUSE-SU-2025:4408-1, SUSE-SU-2025:03368-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 libssh 0.10.6-slfo.1.1_3.1 SUSE-SU-2025:20894-1
SLE Micro 6.0 libssh 0.10.6-3.1 SUSE-SU-2025:20847-1
SLE Micro 5.5 libssh 0.9.8-150400.3.12.1 SUSE-SU-2025:3788-1
SLE Micro 5.4 libssh 0.9.8-150400.3.12.1 SUSE-SU-2025:3788-1
SLE Micro 5.3 libssh 0.9.8-150400.3.12.1 SUSE-SU-2025:3788-1
SLE Micro 5.2 libssh 0.9.8-150200.13.12.1 SUSE-SU-2025:3787-1
SLE Micro 5.1 libssh 0.9.8-150200.13.12.1 SUSE-SU-2025:3787-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libssh 0.11.3-1.1 openSUSE-SU-2025:15545-1
openSUSE Leap 15.6 libssh 0.9.8-150600.11.6.1 SUSE-SU-2025:03369-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 libssh 0.11.3-r0 —
Alpine v3.23 libssh 0.11.3-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libssh +2 0.10.6-1.amzn2023.0.3 ALAS2023-2025-1264

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libssh 0.10.6-5 —
Azure Linux 2 (CBL-Mariner) libssh 0.10.6-5 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 libssh +2 0.10.4-18.el9 ELSA-2026-18683

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libssh-dev 0.11.3-r0 —

Advisories 16

References