Quick answers
- Is CVE-2025-5351 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-5351 being exploited in the wild.
- How severe is CVE-2025-5351?
- Medium severity, with a CVSS score of 6.5, published 4 July 2025.
- Which products and versions are affected?
- Libssh >= 0.10.0, < 0.11.2.
- Is there a fix for CVE-2025-5351?
- A patch was published on 2026-05-19: Red Hat released security updates (RHSA-2026:18683) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-5351 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-5351?
- Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A double free vulnerability exists in libssh within the pki_key_to_blob() function, which is responsible for converting cryptographic keys into serialized formats. The flaw occurs during error handling when a memory structure (params) is freed but the pointer is not cleared; if a subsequent failure occurs later in the same function, the structure is freed a second time. This issue specifically affects libssh versions 0.10.0 and later when built against OpenSSL 3.0 or higher. An authenticated attacker can trigger this condition to cause heap corruption or a denial of service (DoS), particularly in low-memory scenarios. The vulnerability has been addressed in libssh version 0.11.2 and various Red Hat Enterprise Linux updates.
Affected products
- libssh libssh >= 0.10.0, < 0.11.2
- Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0
- Red Hat Openshift Container Platform 4.0
Timeline
- 2025-05-30: other: Bug reported to Red Hat Bugzilla
- 2025-07-04: disclosed: CVE published
- 2026-05-19: patched: Red Hat released security updates (RHSA-2026:18683)