# CVE-2025-8114: libssh NULL pointer dereference in KEX session ID calculation

Source: https://junglewise.ai/threats/cve-2025-8114-libssh-null-pointer-dereference-in-kex-session-id-calculation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-24. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-8114 · Severity: medium · CVSS 4.7 · Published 2025-07-24

libssh is a software library used by many applications to provide secure SSH communication. A flaw in how the library handles memory during the initial connection setup can cause the software to crash if it runs out of memory at a specific moment. This could allow a local user to disrupt services or applications that rely on libssh for secure data transfers.

Technologies: [Libssh](https://junglewise.ai/threats/technologies/libssh). Vendors: [Libssh](https://junglewise.ai/threats/vendors/libssh).

## Quick answers

**Is CVE-2025-8114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-8114 being exploited in the wild.

**How severe is CVE-2025-8114?** Medium severity, with a CVSS score of 4.7, published 24 July 2025.

**Which products and versions are affected?** Libssh up to and including 0.11.2.

**Is there a fix for CVE-2025-8114?** A patch was published on 2025-08-14: Fixes committed to libssh git repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-8114 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-8114?** Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in libssh within the `ssh_make_sessionid` function in `src/kex.c`. During the Key Exchange (KEX) process, the library fails to properly handle memory allocation failures when calculating the session ID. Specifically, if `malloc` fails for `session->next_crypto->session_id`, the code may proceed to dereference the resulting NULL pointer. This issue can be triggered by a local attacker with low privileges under conditions of high memory pressure or specific resource constraints. The flaw results in a crash (Denial of Service) of either the SSH client or server process. Patches have been released in libssh version 0.11.3 and backported to various distribution packages.

## Affected products

- libssh libssh up to and including 0.11.2

## Timeline

- 2025-07-24: disclosed: Initial report and CVE assignment
- 2025-07-24: advisory: NVD and Red Hat published advisory details
- 2025-08-14: patched: Fixes committed to libssh git repository
- 2026-05-19: patched: Red Hat released security updates for RHEL 9

## References

- [https://access.redhat.com/errata/RHSA-2026:18683](https://access.redhat.com/errata/RHSA-2026:18683)
- [https://access.redhat.com/security/cve/CVE-2025-8114](https://access.redhat.com/security/cve/CVE-2025-8114)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2383220](https://bugzilla.redhat.com/show_bug.cgi?id=2383220)
- [https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d](https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d)
- [https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9](https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9)
- [https://www.libssh.org/security/advisories/CVE-2025-8114.txt](https://www.libssh.org/security/advisories/CVE-2025-8114.txt)

## Related threats

- [libssh authentication bypass in GSSAPIKeyExchange](https://junglewise.ai/threats/cve-2026-59851-libssh-authentication-bypass-in-gssapikeyexchange)
- [libssh use-after-free in channel data callbacks](https://junglewise.ai/threats/cve-2026-59850-libssh-use-after-free-in-channel-data-callbacks)
- [libssh infinite loop in certificate-based authentication](https://junglewise.ai/threats/cve-2026-59849-libssh-infinite-loop-in-certificate-based-authentication)
- [libssh denial of service via memory exhaustion in SFTP client](https://junglewise.ai/threats/cve-2026-59848-libssh-denial-of-service-via-memory-exhaustion-in-sftp-client)
- [libssh integrity protection bypass in OpenSSL AES-GCM backend](https://junglewise.ai/threats/cve-2026-59847-libssh-integrity-protection-bypass-in-openssl-aes-gcm-backend)