Heap Space Exhaustion Vulnerability in libssh with OpenSSL Cipher
CVE-2025-5987

5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
7 July 2025

What is CVE-2025-5987?

A vulnerability in libssh arises when using the ChaCha20 cipher in conjunction with the OpenSSL library, which can lead to heap space exhaustion. If an attacker exploits this flaw, they may trigger a situation where a partially initialized cipher context is utilized without detection. This occurs due to the erroneous return of an OpenSSL error code that does not correctly indicate failure, thus allowing libssh to mistakenly interpret the situation as successful. As a consequence, potential risks include data confidentiality breaches, data integrity loss, and application crashes.

References

https://access.redhat.com/security/cve/CVE-2025-5987
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2376219
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-5987 : Heap Space Exhaustion Vulnerability in libssh with OpenSSL Cipher