CVE-2025-5449
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A flaw was found in the SFTP server message decoding logic of libssh. An incorrect packet length check allows an integer overflow on 32-bit systems when handling large payload sizes, leading to failed memory allocation and server process crash, resulting in denial of service.
Risk Assessment
An attacker can remotely crash the SFTP server, causing service unavailability. The vulnerability primarily affects 32-bit systems but can be exploited for DoS attacks.
Recommendation
Update libssh to the patched version immediately. For 32-bit systems, consider temporarily restricting SFTP server access or applying additional network security measures.
Original NVD description (English source)
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.