{"id":"CVE-2025-5987","title":"A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library","summary":"A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This oc…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-393"],"vendor":"libssh","product":"libssh","affected":["libssh >= 0.10.0, < 0.11.2"],"patched":["libssh 0.11.2"],"published":"2025-07-07","updated":"2026-10-16","sourceUpdated":"2026-10-16T11:16:59.160","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-5987","references":[{"url":"https://access.redhat.com/errata/RHSA-2025:23483","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:23484","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0427","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0428","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0430","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0431","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0702","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0978","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0980","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0985","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0996","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:1539","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:1541","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:3415","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2025-5987","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2376219","label":"secalert@redhat.com"},{"url":"https://www.libssh.org/security/advisories/CVE-2025-5987.txt","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5987.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5987"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5987"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0173,"epssPercentile":0.77472,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-01-22T04:55:55.619672Z"},"ingestedAt":"2026-06-29T13:24:34.385Z","slug":"CVE-2025-5987","body":"## Overview\n\nA flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.\n\n## Affected\n\n- `libssh >= 0.10.0, < 0.11.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `libssh 0.11.2`\n\n## Vendor advisories\n\n- **RHSA-2026:3415** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3415)\n- **RHSA-2026:0996** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-01-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:0996)\n- **RHSA-2026:1541** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:1541)\n- **RHSA-2026:0985** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-01-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:0985)\n- **RHSA-2026:0702** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-01-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:0702)\n- **RHSA-2026:0980** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:0980)\n- **RHSA-2026:1539** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-02-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:1539)\n- **RHSA-2026:0978** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-01-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:0978)\n- **RHSA-2025:23484** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2025-12-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:23484)\n- **RHSA-2025:23483** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2025-12-18 · [advisory](https://access.redhat.com/errata/RHSA-2025:23483)\n- **RHSA-2026:0427** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-01-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:0427)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5987.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}