CVE-2025-5449 | Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

Published: 2025-07-25 Last update: 2026-01-08 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2025-5449 is rated Moderate Risk (49.8/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.52%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2025-5449

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-05-21 0.17% 0.52% +0.35%
2 2026-01-03 0.10% 0.17% +0.07%
3 2025-11-24 — 0.10% —

Full EPSS history (5 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-5449

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.5 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.8 3.6 [email protected]
6.5 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.8 3.6 [email protected]

Weakness enumeration for CVE-2025-5449

OS Trackers for CVE-2025-5449

vendor priority summary link
alpine — CVE-2025-5449: 1 source package rows (libssh); 4 state rows across 2 repos (3.22-community, edge-community); fixed 2, open 2. https://security.alpinelinux.org/vuln/CVE-2025-5449
debian unimportant CVE-2025-5449 unimportant priority: Debian including 1 source packages (libssh), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2025-5449
redhat medium — https://access.redhat.com/security/cve/CVE-2025-5449
suse medium CVE-2025-5449 severity moderate: SUSE including 13 source package names (libssh, libssh-config, …), 148 product×package rows across 36 product lines (SLES-LTSS-TERADATA 15 SP2, SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS, … (36 product lines)): Known Not Affected 141, Fixed 7. https://www.suse.com/security/cve/CVE-2025-5449/
ubuntu medium CVE-2025-5449 medium priority: Ubuntu including 1 source packages (libssh), 8 status rows across 8 suites (bionic, focal, jammy, noble, oracular, plucky, upstream, xenial): not-affected 6, released 2. https://ubuntu.com/security/CVE-2025-5449

Affected software / configurations for CVE-2025-5449

Vendor Product Version Raw CPE
libssh libssh 0.11.0 cpe:2.3:a:libssh:libssh:0.11.0:*:*:*:*:*:*:*
libssh libssh 0.11.1 cpe:2.3:a:libssh:libssh:0.11.1:*:*:*:*:*:*:*

References for CVE-2025-5449

URL Tags
https://access.redhat.com/security/cve/CVE-2025-5449 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2369705 Issue Tracking Third Party Advisory
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f Patch
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4da Patch
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7 Patch
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=78485f446af9b30e37eb8f177b81940710d54496 Patch
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=f79ec51b7fd519dbc5737a7ba826e3ed093f6ceb Patch
https://www.libssh.org/security/advisories/CVE-2025-5449.txt Third Party Advisory
cvelogic Threat Intelligence