Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service

Summary

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

Timeline

1. Jul 25, 2025, 5:19 PM UTCCVE published
2. Jul 25, 2025, 5:33 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 31, 2026, 11:28 AM UTCRecord last updated

Affected versions

• libssh

  From 0.11.0 · through 0.11.1

• libssh

  Version range not reported

• libssh2

  Version range not reported

• libssh2

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 8