CVE-2025-5987High· 8.1▾ TwilightA flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This oc…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.4%
1.4% → 1.7%
Last analysed / modified upstream
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
libssh >= 0.10.0, < 0.11.2Upgrade past the affected range:
libssh 0.11.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0968Low· 3.1A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation
CVE-2026-98842Medium· 4.4kernel: module: fix lost error code from codetag_load_module() (CVE-2026-98842)
CVE-2026-98845Medium· 4.5kernel: tpm: Disable TPM on null key name mismatch (CVE-2026-98845)
CVE-2026-72374High· 7.5In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications
CVE-2019-7309Medium· 5.5In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
CVE-2026-92821Medium· 6.8A flaw was found in SSSD