--- id: CVE-2025-5987 title: >- A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library summary: >- A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This oc… severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-393 vendor: libssh product: libssh affected: - 'libssh >= 0.10.0, < 0.11.2' patched: - libssh 0.11.2 published: '2025-07-07' updated: '2026-10-16' sourceUpdated: '2026-10-16T11:16:59.160' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5987' references: - url: 'https://access.redhat.com/errata/RHSA-2025:23483' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:23484' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0427' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0428' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0430' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0431' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0702' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0978' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0980' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0985' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0996' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1539' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1541' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:3415' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2025-5987' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2376219' label: secalert@redhat.com - url: 'https://www.libssh.org/security/advisories/CVE-2025-5987.txt' label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5987.json - url: 'https://www.cve.org/CVERecord?id=CVE-2025-5987' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5987' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.0173 epssPercentile: 0.77472 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-01-22T04:55:55.619672Z' ingestedAt: '2026-06-29T13:24:34.385Z' --- ## Overview A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes. ## Affected - `libssh >= 0.10.0, < 0.11.2` ## Remediation Upgrade past the affected range: - `libssh 0.11.2` ## Vendor advisories - **RHSA-2026:3415** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3415) - **RHSA-2026:0996** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-01-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:0996) - **RHSA-2026:1541** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:1541) - **RHSA-2026:0985** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-01-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:0985) - **RHSA-2026:0702** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-01-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:0702) - **RHSA-2026:0980** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:0980) - **RHSA-2026:1539** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-02-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:1539) - **RHSA-2026:0978** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-01-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:0978) - **RHSA-2025:23484** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2025-12-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:23484) - **RHSA-2025:23483** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2025-12-18 · [advisory](https://access.redhat.com/errata/RHSA-2025:23483) - **RHSA-2026:0427** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-01-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:0427) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5987.json)