Most recent entries from all

ALSA-2026:18683 — Moderate: libssh security update

Affected: AlmaLinux:9: libssh, AlmaLinux:9: libssh-config, AlmaLinux:9: libssh-devel

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

* libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351) * libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878) * libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877) * libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114) * libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277) * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

bdu:2025-13879

BELL-CVE-2025-8277

Affected: Alpaquita:23: libssh, Alpaquita:25: libssh, Alpaquita:stream: libssh

certfr-2025-avi-0969 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0969

EUVD-2026-362303

fkie_cve-2025-8277

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

GHSA-39mw-228p-wr6v

msrc_CVE-2025-8277 — Libssh: memory exhaustion via repeated key exchange in libssh

msrc_CVE-2025-8277

OESA-2025-2342 — libssh security update

Affected: openEuler:22.03-LTS-SP4: libssh, openEuler:24.03-LTS: libssh, openEuler:24.03-LTS-SP1: libssh, openEuler:24.03-LTS-SP2: libssh, openEuler:20.03-LTS-SP4: libssh, openEuler:22.03-LTS-SP3: libssh

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl). Security Fix(es):

openSUSE-SU-2025:15545-1 — libssh-config-0.11.3-1.1 on GA media

libssh-config-0.11.3-1.1 on GA media

SUSE-SU-2025:03368-1 — Security update for libssh

Security update for libssh

UBUNTU-CVE-2025-8277

Affected: Ubuntu:Pro:18.04:LTS: libssh, Ubuntu:Pro:20.04:LTS: libssh, Ubuntu:22.04:LTS: libssh, Ubuntu:24.04:LTS: libssh, Ubuntu:25.10: libssh

WID-SEC-W-2025-2002 — libssh: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in libssh ausnutzen, um einen Denial of Service Angriff durchzuführen.