« List of all CVEs

CVE-2025-5351

Libssh: double free vulnerability in libssh key export functions

Published: 7/4/2025 Last updated: 11/20/2025 Reserved: 5/30/2025

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 4.2 Medium CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Opam packages affected (1)

libssh

Products affected (11)

Product Vendor Version
Red Hat Enterprise Linux 10 Red Hat 16.0(3d)
Red Hat Enterprise Linux 8 Red Hat various
Red Hat Enterprise Linux 9 Red Hat 15.3(1d)
Red Hat Enterprise Linux 10 Red Hat 15.2(4)S5
Red Hat Enterprise Linux 8 Red Hat < d7888c75505465490250c00cc0ef4bb1af662f9f
Red Hat Enterprise Linux 9 Red Hat 15.2(4)S3
Red Hat Enterprise Linux 6 Red Hat Cisco Identity Services Engine
Red Hat Enterprise Linux 7 Red Hat 16.0(3e)
Red Hat Enterprise Linux 7 Red Hat <= 5.4.*
Red Hat Enterprise Linux 6 Red Hat >= 1.11.70, < 1.11.81
Red Hat OpenShift Container Platform 4 Red Hat n/a

References (4)

Credits (2)