Executive brief
libssh is a widely used library that allows applications to communicate securely using the SSH protocol. A flaw in how the library handles security keys during export could allow an authenticated user to crash an application or cause system instability. This typically occurs in low-memory situations and could lead to a denial of service, affecting the reliability of secure connections and data transfers.
Technical details
A double free vulnerability exists in libssh within the pki_key_to_blob() function, which is responsible for converting cryptographic keys into serialized formats. The flaw occurs during error handling when a memory structure (params) is freed but the pointer is not cleared; if a subsequent failure occurs later in the same function, the structure is freed a second time. This issue specifically affects libssh versions 0.10.0 and later when built against OpenSSL 3.0 or higher. An authenticated attacker can trigger this condition to cause heap corruption or a denial of service (DoS), particularly in low-memory scenarios. The vulnerability has been addressed in libssh version 0.11.2 and various Red Hat Enterprise Linux updates.
Affected products
- libssh libssh >= 0.10.0, < 0.11.2
- Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0
- Red Hat Openshift Container Platform 4.0
Timeline
- 2025-05-30: other: Bug reported to Red Hat Bugzilla
- 2025-07-04: disclosed: CVE published
- 2026-05-19: patched: Red Hat released security updates (RHSA-2026:18683)