Unrated severityOSV Advisory· Published Jul 25, 2025· Updated Jan 8, 2026
Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service
CVE-2025-5449
Description
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- access.redhat.com/security/cve/CVE-2025-5449mitrevdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgimitreissue-trackingx_refsource_REDHAT
- git.libssh.org/projects/libssh.git/commit/mitre
- git.libssh.org/projects/libssh.git/commit/mitre
- git.libssh.org/projects/libssh.git/commit/mitre
- git.libssh.org/projects/libssh.git/commit/mitre
- git.libssh.org/projects/libssh.git/commit/mitre
- www.libssh.org/security/advisories/CVE-2025-5449.txtmitre
News mentions
0No linked articles in our index yet.