CVE-2025-8114
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A flaw in libssh causes a NULL pointer dereference when calculating the session ID during the key exchange (KEX) process due to an allocation failure in cryptographic functions. This can crash the client or server.
Risk Assessment
An attacker could exploit this vulnerability to cause a denial of service (DoS) of SSH services, disrupting system availability and potentially requiring manual restart.
Recommendation
Immediately update the libssh library to a patched version that fixes the NULL pointer dereference issue.
Original NVD description (English source)
A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.