A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03369-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).
    - CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the     KEX session ID       (bsc#1246974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03368-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).
    - CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the     KEX session ID       (bsc#1246974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-88ec28aaee advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-50a98965b5 advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9826857157 advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libssh installed on the remote host is prior to 0.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-252-01 advisory.

    New libssh packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID     during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL     pointer dereference. This issue can cause the client or server to crash. (CVE-2025-8114)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
266008	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libssh (SUSE-SU-2025:03369-1)	Nessus	SuSE Local Security Checks	medium
266003	SUSE SLES12 Security Update : libssh (SUSE-SU-2025:03368-1)	Nessus	SuSE Local Security Checks	medium
265815	Fedora 41 : libssh (2025-88ec28aaee)	Nessus	Fedora Local Security Checks	medium
265452	Fedora 43 : libssh (2025-50a98965b5)	Nessus	Fedora Local Security Checks	medium
264591	Fedora 42 : libssh (2025-9826857157)	Nessus	Fedora Local Security Checks	medium
261834	Slackware Linux 15.0 / current libssh Multiple Vulnerabilities (SSA:2025-252-01)	Nessus	Slackware Local Security Checks	medium
245701	Linux Distros Unpatched Vulnerability : CVE-2025-8114	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-8114

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium