PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-8114 Red Hat CVE debrief

A NULL pointer dereference vulnerability exists in libssh versions up to and including 0.11.2. The flaw occurs during the SSH key exchange (KEX) process when calculating the session ID. Specifically, an allocation failure in cryptographic functions can result in a NULL pointer dereference, causing the affected SSH client or server to crash. This represents a denial-of-service condition rather than code execution or information disclosure. The vulnerability requires local access with low privileges and high attack complexity according to the CVSS vector, limiting its practical exploitability. The issue was disclosed on July 24, 2025, with the CVE record subsequently modified on May 19, 2026. Upstream libssh has released security patches addressing this vulnerability.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 9
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2025-07-24
Original CVE updated
2026-05-19
Advisory published
2025-07-24
Advisory updated
2026-05-19

Who should care

Organizations operating SSH services or client applications built on libssh, particularly those running versions 0.11.2 or earlier. System administrators managing Linux distributions with libssh dependencies should prioritize patching. Developers integrating libssh into custom applications should review error handling around cryptographic allocations. Infrastructure teams relying on automated SSH connections for configuration management, CI/CD pipelines, or remote administration should assess exposure to potential denial-of-service disruptions.

Technical summary

The vulnerability stems from insufficient NULL pointer validation following memory allocation failures during cryptographic operations in the SSH key exchange handshake. When session ID calculation fails due to allocation errors, the resulting NULL pointer is dereferenced without proper checks, triggering a crash. This affects both client and server implementations using vulnerable libssh versions. The attack surface is constrained by the local attack vector and high complexity requirements, with no confidentiality or integrity impacts—only availability disruption through service termination.

Defensive priority

medium

Recommended defensive actions

  • Upgrade libssh to a version newer than 0.11.2
  • Apply vendor security patches from libssh upstream or distribution maintainers
  • Monitor for availability anomalies in SSH services that may indicate exploitation attempts
  • Review SSH service crash logs for unexpected termination patterns
  • Validate cryptographic library memory allocation handling in custom libssh integrations

Evidence notes

Vulnerability affects libssh versions through 0.11.2 per NVD CPE criteria. CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector, high complexity, low privileges required, no user interaction, with availability impact as the sole consequence. CWE-476 (NULL Pointer Dereference) classified as secondary weakness source. Multiple git commits identified as remediation. Red Hat has issued security advisory RHSA-2026:18683.

Official resources

2025-07-24