A flaw was found in libssh in the server-side GSSAPI Curve25519 key exchange path in src/kex-gss.c. In ssh_server_gss_kex_process_init(), a client-controlled SSH string is unpacked into client_pubkey and then copied with memcpy(..., CURVE25519_PUBKEY_SIZE) without validating ssh_string_len(client_pubkey). A remote unauthenticated client can send a short public key in SSH_MSG_KEXGSS_INIT and trigger an out-of-bounds heap read during handshake processing, disclosing small amounts of adjacent server memory.