Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-5351
Good to know:
Date: July 4, 2025
In libssh 0.10.0 before 0.11.2 pki_key_to_blob() can cause a double free on certain errors when using OpenSSL = 3.0. The function is used by different other functions which allow to export public or private keys to blobs or base64. The function is using the variable params without resetting it to NULL after free. In case of low-memory conditions when the allocation of string fails, the libssh calls the OSSL_PARAM_free() with the same arguments, which will likely crash.
Severity Score
Related Resources (6)
Severity Score
Top Fix
Upgrade Version
Upgrade to version https://git.libssh.org/projects/libssh.git - libssh-0.11.2
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | LOW |
| Availability (A): | NONE |