CVE-2025-5987: libssh (CVSS 8.1)

Description

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

Is your site exposed to CVE-2025-5987?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-393 CWE-393

Affected Products

Vendor	Product	Versions
libssh	libssh	0.10.0 — 0.11.2

References

Other References

https://access.redhat.com/errata/RHSA-2025:23483 https://access.redhat.com/errata/RHSA-2025:23484 https://access.redhat.com/errata/RHSA-2026:0427 https://access.redhat.com/errata/RHSA-2026:0428 https://access.redhat.com/errata/RHSA-2026:0430 https://access.redhat.com/errata/RHSA-2026:0431 https://access.redhat.com/errata/RHSA-2026:0702 https://access.redhat.com/errata/RHSA-2026:0978 https://access.redhat.com/errata/RHSA-2026:0980 https://access.redhat.com/errata/RHSA-2026:0985

Frequently Asked Questions

What is CVE-2025-5987? +

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes. It has a CVSS v3.1 base score of 8.1 (HIGH).

How severe is CVE-2025-5987? +

CVE-2025-5987 has a CVSS v3.1 score of 8.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-5987? +

CVE-2025-5987 affects products from libssh, specifically: libssh. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-5987? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-85483

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: …

CVE-2026-42246

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a …

CVE-2026-85087

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before …

CVE-2026-9058

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") …

CVE-2026-92834

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache …

CVE-2024-49117 8.8

Windows Hyper-V Remote Code Execution Vulnerability

CVE-2025-5987