CVE-2025-58181
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Risk Assessment
An attacker could exhaust SSH server memory, causing denial of service or system instability.
Recommendation
Update the SSH server software to a version that validates the number of GSSAPI mechanisms.
Other vulnerabilities in SSH server
See all- CVE-2025-22869High
SSH servers implementing file transfer protocols are vulnerable to a denial of service attack from clients that complete the key exchange slowly or not at all, causing pending content to be read into memory but never transmitted.
- CVE-1999-1010Low
SSH server version 1.2.27 allows a client to use the 'none' cipher, even if it is not permitted by the server policy.
Original NVD description (English source)
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS