Junglewise Threat Intelligence

CVE-2025-5449: libssh integer overflow in SFTP server message decoding

CVE-2025-5449 · Severity: medium · CVSS 6.5 · Published 2025-07-25

Technologies: Libssh. Vendors: Libssh.

Executive brief

libssh is a library used by applications to provide secure file transfers (SFTP) and remote command execution. A flaw in how the library handles SFTP messages on 32-bit systems allows an authenticated user to crash the server by sending a specially crafted large data packet. This results in a denial of service, preventing legitimate users from accessing the file transfer service.

Technical details

An integer overflow vulnerability exists in the SFTP server message decoding logic of libssh, specifically within the sftp_decode_channel_data_to_packet() function. On 32-bit platforms, an incorrect packet length check allows a crafted packet with a large payload size (e.g., 0x7ffffffc) to bypass validation. This leads to a failed memory allocation and a subsequent process crash. The attack requires the attacker to be authenticated with SFTP access. The issue is fixed in libssh versions 0.11.4 and 0.12.0.

Affected products

  • libssh libssh 0.11.0, 0.11.1

Timeline

  • 2025-06-02: disclosed: Reported to Red Hat Bugzilla
  • 2025-06-24: patched: Fixes committed to stable-0.11 branch
  • 2025-07-25: advisory: NVD publication date

References

Related threats