Junglewise Threat Intelligence

CVE-2025-8114: libssh NULL pointer dereference in KEX session ID calculation

CVE-2025-8114 · Severity: medium · CVSS 4.7 · Published 2025-07-24

Technologies: Libssh. Vendors: Libssh.

Executive brief

libssh is a software library used by many applications to provide secure SSH communication. A flaw in how the library handles memory during the initial connection setup can cause the software to crash if it runs out of memory at a specific moment. This could allow a local user to disrupt services or applications that rely on libssh for secure data transfers.

Technical details

A vulnerability exists in libssh within the `ssh_make_sessionid` function in `src/kex.c`. During the Key Exchange (KEX) process, the library fails to properly handle memory allocation failures when calculating the session ID. Specifically, if `malloc` fails for `session->next_crypto->session_id`, the code may proceed to dereference the resulting NULL pointer. This issue can be triggered by a local attacker with low privileges under conditions of high memory pressure or specific resource constraints. The flaw results in a crash (Denial of Service) of either the SSH client or server process. Patches have been released in libssh version 0.11.3 and backported to various distribution packages.

Affected products

  • libssh libssh up to and including 0.11.2

Timeline

  • 2025-07-24: disclosed: Initial report and CVE assignment
  • 2025-07-24: advisory: NVD and Red Hat published advisory details
  • 2025-08-14: patched: Fixes committed to libssh git repository
  • 2026-05-19: patched: Red Hat released security updates for RHEL 9

References

Related threats