CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
Attackers can cause undefined behavior, data compromise, or crashes in libssh by exhausting heap space when using ChaCha20 with OpenSSL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5987?
CVE-2025-5987 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 7 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
Weakness: CWE-393
Which versions are affected by CVE-2025-5987?
It affects 1 product.
Linux distribution packages (22)
libssh-config AlmaLinux:10 | All versions | 0.11.1-5.el10_1 |
libssh AlmaLinux:9 | All versions | 0.10.4-17.el9_7 |
libssh-config AlmaLinux:9 | All versions | 0.10.4-17.el9_7 |
libssh-devel AlmaLinux:9 | All versions | 0.10.4-17.el9_7 |
libssh Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-5.el10_1 |
libssh-config Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-5.el10_1 |
libssh-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-5.el10_1 |
libssh-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-5.el10_1 |
libssh-devel Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-5.el10_1 |
libssh-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-17.el9_7 |
libssh-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-17.el9_7 |
libssh-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-17.el9_7 |
libssh Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-17.el9_7 |
libssh-config Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-17.el9_7 |
libssh-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-17.el9_7 |
libssh-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-17.el9_7 |
libssh Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.11.1-4.el10_0.1 |
libssh Red Hat:rhel_e4s:9.2::baseos | All versions | 0:0.10.4-9.el9_2.2 |
libssh Red Hat:rhel_eus:9.4::baseos | All versions | 0:0.10.4-13.el9_4.2 |
libssh Red Hat:rhel_eus:9.6::baseos | All versions | 0:0.10.4-15.el9_6.1 |
libssh Rocky Linux:10 | All versions | 0:0.11.1-5.el10_1 |
libssh Rocky Linux:9 | All versions | 0:0.10.4-17.el9_7 |
Products include Libssh Libssh.
How do I fix CVE-2025-5987?
Apply the vendor's patch.
Is CVE-2025-5987 being exploited?
There is no known exploitation of CVE-2025-5987 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Enterprise Linux 10
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
- CVE-2012-6063 Use after free in n/a
Sources
Also known as ALSA-2025:23483, ALSA-2025:23484, AZL-64794, AZL-64797, BELL-CVE-2025-5987, CLSA-2025-1762361016 and 15 more.