CVE-2025-5987: Libssh: invalid return code for chacha20 poly1305 with openssl backend
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSHOK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
Other sources
If there is an error in initializing ChaCha20 cipher with OpenSSL, an invalid error code is returned. This can happen if there is an heap exhaustion. This error is not correctly detected and could allow libssh to use partially initialized cipher context. This is caused by the mismatch of return value meaning from OpenSSL and libssh, where OpenSSL error (rv=0) aliases with SSHOK (0) and is returned directly from the function chacha20poly1305setkey(). This will likely cause error somewhere down the road.
— Red Hat
Libssh: invalid return code for chacha20 poly1305 with openssl backend
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5987?
CVE-2025-5987 has a high severity due to the potential for attackers to exploit heap exhaustion leading to security breaches.
How do I fix CVE-2025-5987?
To fix CVE-2025-5987, it is recommended to update both libssh and OpenSSL to their latest versions where the vulnerability has been patched.
What systems are affected by CVE-2025-5987?
CVE-2025-5987 affects systems utilizing libssh with the ChaCha20 cipher in conjunction with the OpenSSL library.
What type of vulnerability is CVE-2025-5987?
CVE-2025-5987 is a cryptographic vulnerability that arises from improper handling of memory related to cipher context initialization.
Can CVE-2025-5987 be exploited remotely?
Yes, CVE-2025-5987 can potentially be exploited remotely by an attacker if they manage to craft requests that exhaust the heap space.