CVE-2025-5449: Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Other sources
Integer Overflow vulnerability in the SFTP server implementation of libssh. The flaw exists in the sftpdecodechanneldatatopacket() function, where a crafted packet with a large payload size (e.g., 0x7ffffffc) bypasses a validity check due to integer overflow on 32-bit platforms. While this does not lead to direct memory corruption, the failure to allocate the excessively large buffer results in a self-induced denial of service (DoS). This issue can only be exploited by authenticated users with SFTP access and affects servers running on 32-bit systems.
Affected versions: libssh 0.11.0 and 0.11.1
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5449?
CVE-2025-5449 is considered to have a moderate severity due to the potential for integer overflow leading to memory allocation failure.
How do I fix CVE-2025-5449?
To fix CVE-2025-5449, update libssh to version 0.11.2 or later, which addresses the integer overflow issue.
Which versions of libssh are affected by CVE-2025-5449?
CVE-2025-5449 affects libssh versions 0.11.0 to 0.11.1 inclusive.
What are the potential consequences of CVE-2025-5449?
The consequences of CVE-2025-5449 include server crashes or denial of service due to failed memory allocation.
Is CVE-2025-5449 specific to certain systems?
Yes, CVE-2025-5449 is particularly problematic on 32-bit systems due to the integer overflow vulnerability.