Threat Investigation
Request a demo

CVE-2025-5987

High

Description

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

SeverityHigh
CVSS8.1
Exploit probability—
ProductLibssh
PublishedJul 7, 2025
First seenJul 7, 2025
Weakness typeCWE-393CWE-393

How to fix

Update
  • libssh libssh0.11.2 or later
Vendor advisories

Affected products

ProductAffected versionsFixed in
libssh libssh0.10.0 ≤ v < 0.11.20.11.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.