CVE-2025-5351
July 04, 2025
In libssh 0.10.0 before 0.11.2 pki_key_to_blob() can cause a double free on certain errors when using OpenSSL
= 3.0. The function is used by different other functions which allow to
export public or private keys to blobs or base64.
The function is using the variable params without resetting it to NULL after
free. In case of low-memory conditions when the allocation of string fails,
the libssh calls the OSSL_PARAM_free() with the same arguments, which will
likely crash.
Affected Packages
https://git.libssh.org/projects/libssh.git (SCM_GIT):
Affected version(s) >=libssh-0.5.1 <libssh-0.11.2Fix Suggestion:
Update to version libssh-0.11.2Related Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Exploit Maturity
PROOF-OF-CONCEPT
Weakness Type (CWE)
Double Free
EPSS
Base Score:
0.09
