CVE-2025-8277
Publication date 9 September 2025
Last updated 15 September 2025
Ubuntu priority
A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.
Read the notes from the security team
Why is this CVE low priority?
libssh developers consider this to be a low severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libssh | 25.04 plucky |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Notes
mdeslaur
This does not affect servers, only clients and is only a memory leak that may eventually lead to a crash.
Patch details
| Package | Patch details |
|---|---|
| libssh |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.1 · Low
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |