Bug 2383888 (CVE-2025-8277) - CVE-2025-8277 libssh: Memory Exhaustion via Repeated Key Exchange in libssh
Summary: CVE-2025-8277 libssh: Memory Exhaustion via Repeated Key Exchange in libssh
Keywords:
Status: NEW
Alias: CVE-2025-8277
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2394044 2394045 2394046 2394047 2394048 2394049 2394050 2394051 2394052
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-28 11:06 UTC by OSIDB Bzimport
Modified: 2026-06-02 08:27 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:18683 0 None None None 2026-05-19 13:00:48 UTC

Description OSIDB Bzimport 2025-07-28 11:06:00 UTC 
Memory Exhaustion vulnerability in the key exchange logic of the libssh library. When an authenticated client repeatedly performs rekeying with incorrect first_kex_packet_follows guesses, libssh allocates new ephemeral key pairs without freeing old ones stored in session->next_crypto. Over time, this results in a memory leak that can exhaust system memory and cause a client-side denial-of-service (DoS). This flaw affects several KEX algorithms (Curve25519, ECDH, sntrup761x25519, DH-GEX) across multiple crypto backends (libgcrypt, OpenSSL, mbedTLS). The issue requires an authenticated client and does not impact the server side.
Versions Affected : libssh >= 0.6.0
Comment 1 Abhishek Raj 2025-09-29 11:58:56 UTC 
Version affected : libssh >= 0.6.0, <= 0.11.3
Comment 2 errata-xmlrpc 2026-05-19 13:00:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:18683 https://access.redhat.com/errata/RHSA-2026:18683
Note You need to log in before you can comment on or make changes to this bug.