A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

unity_linux UTSA-2025-991099: Unity Linux: libssh (UTSA-2025-991099)

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4385 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4385-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     November 27, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libssh     Version        : 0.9.8-0+deb11u2     CVE ID         : CVE-2025-4877 CVE-2025-4878 CVE-2025-5318 CVE-2025-5372                      CVE-2025-8114 CVE-2025-8277     Debian Bug     : 1108407 1109860 1114859

    Several vulnerabilities have been found in libssh, a tiny C SSH library.

    CVE-2025-4877

        Ronald Crane found that bin_to_base64() could experience an integer         overflow and subsequent under allocation, leading to an out of         bounds write on 32-bit builds.

    CVE-2025-4878

        Ronald Crane found that privatekey_from_file() used an uninitialized         variable under certain conditions, which could lead to signing         failure, use-after-free or memory corruption.

    CVE-2025-5318

        Ronald Crane found that sftp_handle() had an incorrect check, which         could lead to an out of bounds read.

    CVE-2025-5372

        Ronald Crane found that ssh_kdf() returned a success code on         certain failures, which could lead to use of uninitialized         cryptographic keys and failing to encrypt/decrypt following         communication.

    CVE-2025-8114

        Philippe Antoine found a null pointer dereference issue when libssh         calculates the session id for the key exchange (KEX) process and an         error happens when allocating memory using cryptographic functions,         leading to a crash.

    CVE-2025-8277

        Francesco Rollo a memory leak during the KEX process when a client         sets the `first_kex_packet_follows` flag in the KEXINIT message and         repeatedly makes incorrect KEX guesses.

    For Debian 11 bullseye, these problems have been fixed in version     0.9.8-0+deb11u2.

    We recommend that you upgrade your libssh packages.

    For the detailed security status of libssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990957 advisory.

    A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends     incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually     exhaust system memory. This issue can lead to crashes on the client side, particularly when using     libgcrypt, which impacts application stability and availability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1264 advisory.

    NULL Pointer Dereference vulnerability in the session ID calculation logic of the libssh library. The flaw     arises from improper handling of allocation errors during cryptographic operations in the key exchange     (KEX) phase. If a memory allocation fails, the resulting NULL pointer may be dereferenced, leading to a     crash in both SSH clients and servers. This vulnerability can be exploited by a local attacker with     limited privileges and no user interaction, potentially disrupting services that rely on libssh for secure     communication.The issue affects libssh versions up to and including 0.11.2. (CVE-2025-8114)

    A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends     incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually     exhaust system memory. This issue can lead to crashes on the client side, particularly when using     libgcrypt, which impacts application stability and availability. (CVE-2025-8277)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:3897-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03369-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).
    - CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the     KEX session ID       (bsc#1246974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03368-1 advisory.

    - CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX     process is       repeated with incorrect guesses (bsc#1249375).
    - CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the     KEX session ID       (bsc#1246974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-88ec28aaee advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-50a98965b5 advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9826857157 advisory.

    New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends     incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually     exhaust system memory. This issue can lead to crashes on the client side, particularly when using     libgcrypt, which impacts application stability and availability. (CVE-2025-8277)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of libssh installed on the remote host is prior to 0.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-252-01 advisory.

    New libssh packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277290	Debian dla-4385 : libssh-4 - security update	Nessus	Debian Local Security Checks	high
276654	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libssh (UTSA-2025-990957)	Nessus	Unity Linux Local Security Checks	low
274674	Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2025-1264)	Nessus	Amazon Linux Local Security Checks	medium
272145	SUSE SLES12 Security Update : libssh (SUSE-SU-2025:3897-1)	Nessus	SuSE Local Security Checks	low
266008	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libssh (SUSE-SU-2025:03369-1)	Nessus	SuSE Local Security Checks	medium
266003	SUSE SLES12 Security Update : libssh (SUSE-SU-2025:03368-1)	Nessus	SuSE Local Security Checks	medium
265815	Fedora 41 : libssh (2025-88ec28aaee)	Nessus	Fedora Local Security Checks	medium
265452	Fedora 43 : libssh (2025-50a98965b5)	Nessus	Fedora Local Security Checks	medium
264591	Fedora 42 : libssh (2025-9826857157)	Nessus	Fedora Local Security Checks	medium
264494	Linux Distros Unpatched Vulnerability : CVE-2025-8277	Nessus	Misc.	low
261834	Slackware Linux 15.0 / current libssh Multiple Vulnerabilities (SSA:2025-252-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2025-8277

low

Tenable Plugins

Coming Soon

high

low

medium

low

medium

medium

medium

medium

medium

low

medium