PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-5351 Red Hat CVE debrief

A double-free vulnerability exists in libssh's key export functionality. The flaw occurs in an internal function that converts cryptographic keys to serialized formats: during error handling, a memory structure is freed without being cleared, creating a double-free condition if a subsequent failure occurs later in the same function. This can lead to heap corruption or application instability, particularly in low-memory environments where key export operations are performed. The vulnerability is classified as CWE-415 (Double Free) and affects libssh versions from 0.10.0 up to but not including 0.11.2. Red Hat has issued security advisory RHSA-2026:18683 addressing this issue across multiple Enterprise Linux versions and OpenShift Container Platform 4.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact.

Vendor
Red Hat
Product
OpenShift Container Platform
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-07-04
Original CVE updated
2026-08-21
Advisory published
2025-07-04
Advisory updated
2026-08-21

Who should care

Organizations running applications that perform SSH key export operations using libssh versions 0.10.0 through 0.11.1, particularly those deployed on Red Hat Enterprise Linux 6-10 or OpenShift Container Platform 4.0. System administrators managing SSH infrastructure and developers building applications with libssh's key management APIs should prioritize patching.

Technical summary

The vulnerability resides in libssh's internal key serialization function. During error path execution, a pointer is freed but not nulled; if a second error occurs before function exit, the same pointer may be freed again, causing heap corruption. The condition is reachable during cryptographic key export operations and is exacerbated in resource-constrained environments. The fix ensures proper pointer hygiene in error handling paths.

Defensive priority

medium

Recommended defensive actions

  • Upgrade libssh to version 0.11.2 or later to eliminate the double-free condition in key export operations.
  • Apply Red Hat security advisory RHSA-2026:18683 for supported Enterprise Linux and OpenShift Container Platform deployments.
  • Monitor application logs for instability or crashes during SSH key export operations as potential indicators of exploitation attempts.
  • Review custom applications using libssh for direct key export API calls and ensure proper error handling patterns.
  • Consider memory allocation limits and monitoring in low-memory environments where key export operations occur frequently.

Evidence notes

Vulnerability description and CPE criteria sourced from NVD modified feed. CWE-415 classification and CVSS vector confirmed via NVD metadata. Red Hat advisory RHSA-2026:18683 and Bugzilla tracking issue 2369367 provide vendor confirmation and remediation status.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-5351 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-5351

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-5351 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-5351

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.