CVE-2025-5449

Katalog CVE

CVSS 6.5 · Medium EPSS 0,88%

Kerentanan Integer Overflow or Wraparound pada libssh. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

Rincian

Terbit di NVD

25 Juli 2025

Terakhir diubah

31 Agustus 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 57,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f patch
• https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4da patch
• https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7 patch
• https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=78485f446af9b30e37eb8f177b81940710d54496 patch
• https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=f79ec51b7fd519dbc5737a7ba826e3ed093f6ceb patch
• https://access.redhat.com/security/cve/CVE-2025-5449 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2369705 issue tracking · advisory pihak ketiga
• https://www.libssh.org/security/advisories/CVE-2025-5449.txt advisory pihak ketiga