# CVE-2025-5449: libssh integer overflow in SFTP server message decoding

Source: https://junglewise.ai/threats/cve-2025-5449-libssh-integer-overflow-in-sftp-server-message-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-5449 · Severity: medium · CVSS 6.5 · Published 2025-07-25

libssh is a library used by applications to provide secure file transfers (SFTP) and remote command execution. A flaw in how the library handles SFTP messages on 32-bit systems allows an authenticated user to crash the server by sending a specially crafted large data packet. This results in a denial of service, preventing legitimate users from accessing the file transfer service.

Technologies: [Libssh](https://junglewise.ai/threats/technologies/libssh). Vendors: [Libssh](https://junglewise.ai/threats/vendors/libssh).

## Quick answers

**Is CVE-2025-5449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5449 being exploited in the wild.

**How severe is CVE-2025-5449?** Medium severity, with a CVSS score of 6.5, published 25 July 2025.

**Which products and versions are affected?** Libssh 0.11.0, 0.11.1.

**Is there a fix for CVE-2025-5449?** A patch was published on 2025-06-24: Fixes committed to stable-0.11 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-5449 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-5449?** Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the SFTP server message decoding logic of libssh, specifically within the sftp_decode_channel_data_to_packet() function. On 32-bit platforms, an incorrect packet length check allows a crafted packet with a large payload size (e.g., 0x7ffffffc) to bypass validation. This leads to a failed memory allocation and a subsequent process crash. The attack requires the attacker to be authenticated with SFTP access. The issue is fixed in libssh versions 0.11.4 and 0.12.0.

## Affected products

- libssh libssh 0.11.0, 0.11.1

## Timeline

- 2025-06-02: disclosed: Reported to Red Hat Bugzilla
- 2025-06-24: patched: Fixes committed to stable-0.11 branch
- 2025-07-25: advisory: NVD publication date

## References

- [https://www.libssh.org/](https://www.libssh.org/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2025-5449](https://access.redhat.com/security/cve/CVE-2025-5449)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2369705](https://bugzilla.redhat.com/show_bug.cgi?id=2369705)
- [https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f](https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f)
- [https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4da](https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4da)
- [https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7](https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7)

## Related threats

- [libssh authentication bypass in GSSAPIKeyExchange](https://junglewise.ai/threats/cve-2026-59851-libssh-authentication-bypass-in-gssapikeyexchange)
- [libssh use-after-free in channel data callbacks](https://junglewise.ai/threats/cve-2026-59850-libssh-use-after-free-in-channel-data-callbacks)
- [libssh infinite loop in certificate-based authentication](https://junglewise.ai/threats/cve-2026-59849-libssh-infinite-loop-in-certificate-based-authentication)
- [libssh denial of service via memory exhaustion in SFTP client](https://junglewise.ai/threats/cve-2026-59848-libssh-denial-of-service-via-memory-exhaustion-in-sftp-client)
- [libssh integrity protection bypass in OpenSSL AES-GCM backend](https://junglewise.ai/threats/cve-2026-59847-libssh-integrity-protection-bypass-in-openssl-aes-gcm-backend)