Medium severity6.5OSV Advisory· Published Jul 25, 2025· Updated Jun 30, 2026

CVE-2025-5449

Description

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libssh/LibsshOSV4 versions
libssh-0.11.0, libssh-0.11.1, libssh-0.8.0, …+ 3 more
- (no CPE)range: libssh-0.11.0, libssh-0.11.1, libssh-0.8.0, …
- cpe:2.3:a:libssh:libssh:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:libssh:libssh:0.11.1:*:*:*:*:*:*:*
- (no CPE)
osv-coords
pkg:rpm/opensuse/libssh&distro=openSUSE%20Tumbleweed
Range: < 0.11.2-1.1

Patches

Vulnerability mechanics

References

git.libssh.org/projects/libssh.git/commit/nvdPatch
git.libssh.org/projects/libssh.git/commit/nvdPatch
git.libssh.org/projects/libssh.git/commit/nvdPatch
git.libssh.org/projects/libssh.git/commit/nvdPatch
git.libssh.org/projects/libssh.git/commit/nvdPatch
access.redhat.com/security/cve/CVE-2025-5449nvdThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
www.libssh.org/security/advisories/CVE-2025-5449.txtnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000