A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990926 advisory.

    A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID     during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL     pointer dereference. This issue can cause the client or server to crash.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990912 advisory.

    A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID     during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL     pointer dereference. This issue can cause the client or server to crash.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the     ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values     where OpenSSL uses 0 to indicate failure and libssh uses 0 for successthe function may mistakenly     return a success status even when key derivation fails. This results in uninitialized cryptographic key     buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality,     integrity, and availability.(CVE-2025-5372)

    A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID     during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL     pointer dereference. This issue can cause the client or server to crash.(CVE-2025-8114)

    There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large     input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can     experience an integer overflow leading to a memory under allocation, when that happens it's possible that     the program perform out of bounds write leading to a heap corruption.
    This issue affects only 32-bits builds of libssh.(CVE-2025-4877)

    A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in     the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename     doesn't exist and may lead to possible signing failures or heap corruption.(CVE-2025-4878)

Tenable has extracted the preceding description block directly from the EulerOS libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large     input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can     experience an integer overflow leading to a memory under allocation, when that happens it's possible that     the program perform out of bounds write leading to a heap corruption.
    This issue affects only 32-bits builds of libssh.(CVE-2025-4877)

    A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in     the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename     doesn't exist and may lead to possible signing failures or heap corruption.(CVE-2025-4878)

    A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the     ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values     where OpenSSL uses 0 to indicate failure and libssh uses 0 for successthe function may mistakenly     return a success status even when key derivation fails. This results in uninitialized cryptographic key     buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality,     integrity, and availability.(CVE-2025-5372)

    A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID     during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL     pointer dereference. This issue can cause the client or server to crash.(CVE-2025-8114)

Tenable has extracted the preceding description block directly from the EulerOS libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1264 advisory.

    NULL Pointer Dereference vulnerability in the session ID calculation logic of the libssh library. The flaw     arises from improper handling of allocation errors during cryptographic operations in the key exchange     (KEX) phase. If a memory allocation fails, the resulting NULL pointer may be dereferenced, leading to a     crash in both SSH clients and servers. This vulnerability can be exploited by a local attacker with     limited privileges and no user interaction, potentially disrupting services that rely on libssh for secure     communication.The issue affects libssh versions up to and including 0.11.2. (CVE-2025-8114)

    A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends     incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually     exhaust system memory. This issue can lead to crashes on the client side, particularly when using     libgcrypt, which impacts application stability and availability. (CVE-2025-8277)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7849-1 advisory.

    Philippe Antoine discovered that libssh did not properly manage memory when calculating a session id     during the key exchange process. An attacker could possibly use this issue to cause libssh to crash,     resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03369-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).
    - CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the     KEX session ID       (bsc#1246974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03368-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).
    - CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the     KEX session ID       (bsc#1246974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-88ec28aaee advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-50a98965b5 advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9826857157 advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libssh installed on the remote host is prior to 0.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-252-01 advisory.

    New libssh packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID     during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL     pointer dereference. This issue can cause the client or server to crash. (CVE-2025-8114)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275472	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libssh (UTSA-2025-990926)	Nessus	Unity Linux Local Security Checks	medium
275431	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh (UTSA-2025-990912)	Nessus	Unity Linux Local Security Checks	medium
274927	EulerOS 2.0 SP12 : libssh (EulerOS-SA-2025-2332)	Nessus	Huawei Local Security Checks	high
274919	EulerOS 2.0 SP10 : libssh (EulerOS-SA-2025-2420)	Nessus	Huawei Local Security Checks	high
274867	EulerOS 2.0 SP12 : libssh (EulerOS-SA-2025-2363)	Nessus	Huawei Local Security Checks	high
274860	EulerOS 2.0 SP10 : libssh (EulerOS-SA-2025-2392)	Nessus	Huawei Local Security Checks	high
274674	Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2025-1264)	Nessus	Amazon Linux Local Security Checks	medium
272303	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : libssh vulnerability (USN-7849-1)	Nessus	Ubuntu Local Security Checks	medium
266008	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libssh (SUSE-SU-2025:03369-1)	Nessus	SuSE Local Security Checks	medium
266003	SUSE SLES12 Security Update : libssh (SUSE-SU-2025:03368-1)	Nessus	SuSE Local Security Checks	medium
265815	Fedora 41 : libssh (2025-88ec28aaee)	Nessus	Fedora Local Security Checks	medium
265452	Fedora 43 : libssh (2025-50a98965b5)	Nessus	Fedora Local Security Checks	medium
264591	Fedora 42 : libssh (2025-9826857157)	Nessus	Fedora Local Security Checks	medium
261834	Slackware Linux 15.0 / current libssh Multiple Vulnerabilities (SSA:2025-252-01)	Nessus	Slackware Local Security Checks	medium
245701	Linux Distros Unpatched Vulnerability : CVE-2025-8114	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-8114

medium

Tenable Plugins

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium