PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-5351 Red Hat CVE debrief

A double-free vulnerability exists in libssh's key export functionality. The flaw occurs in an internal function that converts cryptographic keys to serialized formats: during error handling, a memory structure is freed without being cleared, creating a double-free condition if a subsequent failure occurs later in the same function. This can lead to heap corruption or application instability, particularly in low-memory environments where key export operations are performed. The vulnerability is classified as CWE-415 (Double Free) and affects libssh versions from 0.10.0 up to but not including 0.11.2. Red Hat has issued security advisory RHSA-2026:18683 addressing this issue across multiple Enterprise Linux versions and OpenShift Container Platform 4.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact.

Vendor
Red Hat
Product
OpenShift Container Platform
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-07-04
Original CVE updated
2026-05-19
Advisory published
2025-07-04
Advisory updated
2026-05-19

Who should care

Organizations running applications that perform SSH key export operations using libssh versions 0.10.0 through 0.11.1, particularly those deployed on Red Hat Enterprise Linux 6-10 or OpenShift Container Platform 4.0. System administrators managing SSH infrastructure and developers building applications with libssh's key management APIs should prioritize patching.

Technical summary

The vulnerability resides in libssh's internal key serialization function. During error path execution, a pointer is freed but not nulled; if a second error occurs before function exit, the same pointer may be freed again, causing heap corruption. The condition is reachable during cryptographic key export operations and is exacerbated in resource-constrained environments. The fix ensures proper pointer hygiene in error handling paths.

Defensive priority

medium

Recommended defensive actions

  • Upgrade libssh to version 0.11.2 or later to eliminate the double-free condition in key export operations.
  • Apply Red Hat security advisory RHSA-2026:18683 for supported Enterprise Linux and OpenShift Container Platform deployments.
  • Monitor application logs for instability or crashes during SSH key export operations as potential indicators of exploitation attempts.
  • Review custom applications using libssh for direct key export API calls and ensure proper error handling patterns.
  • Consider memory allocation limits and monitoring in low-memory environments where key export operations occur frequently.

Evidence notes

Vulnerability description and CPE criteria sourced from NVD modified feed. CWE-415 classification and CVSS vector confirmed via NVD metadata. Red Hat advisory RHSA-2026:18683 and Bugzilla tracking issue 2369367 provide vendor confirmation and remediation status.

Official resources

2025-07-04T09:15:37.100Z