CVE-2025-5987: libssh Return of Wrong Status Code
Vulnerability summary
CVE-2025-5987 is a high (CVSS 8.1) Return of Wrong Status Code vulnerability in libssh. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 07-07-2025PublishedVulnerability first disclosed.
- 16-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.73%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
+0.24 pp
From 1.49% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- libssh< 0:0.10.4-17.el9_7 | < 0:0.11.1-5.el10_1 | < 0:0.11.1-4.el10_0.1 | < 0:0.10.4-15.el9_6.1 | < 0:0.10.4-9.el9_2.2 | < 0:0.10.4-13.el9_4.2
- libssh-config< 0:0.10.4-17.el9_7 | < 0:0.11.1-5.el10_1
- libssh-debuginfo< 0:0.10.4-17.el9_7 | < 0:0.11.1-5.el10_1
- libssh-debugsource< 0:0.10.4-17.el9_7 | < 0:0.11.1-5.el10_1
- libssh-devel< 0:0.10.4-17.el9_7 | < 0:0.11.1-5.el10_1
Chainguard2 products
- libssh< 0.11.3-r0
- libssh2< 1.11.1-r1
Wolfi2 products
- libssh< 0.11.3-r0
- libssh2< 1.11.1-r1
Debian1 product
- libssh< 0.10.6-0+deb12u2 | < 0.11.2-1
Libssh1 product
- libssh≥ 0.10.0, < 0.11.2
Ubuntu1 product
- libssh< 0.10.6-2ubuntu0.1
6 vendors · 12 products
References
33 linksShow all 33 references
- access.redhat.com/security/cve/CVE-2025-5987VDB EntryX Refsource REDHATREPORTAdvisoryThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2376219Issue TrackingX Refsource REDHATREPORTThird Party Advisory
