CVE-2025-8277: libssh
Vulnerability summary
CVE-2025-8277 is a low (CVSS 3.1) vulnerability in libssh. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 9Timeline
- 09-09-2025PublishedVulnerability first disclosed.
- 01-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.03 pp
From 0.40% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libssh< 0.10.6-0+deb12u2 | < 0.11.2-1+deb13u1 | < 0.11.3-1
Suse1 product
- libssh&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 0.6.3-12.18.1
Ubuntu1 product
- libssh< 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6 | < 0.9.3-2ubuntu2.5+esm3 | < 0.9.6-2ubuntu0.22.04.6 | < 0.10.6-2ubuntu0.3 | < 0.11.2-1ubuntu0.2
3 vendors · 3 products
