CVE-2025-5351CWE-415

CVE-2025-5351

Medium · published July 4, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-415 · Double Free
Published
2025-07-04T13:15Z
Affected products (7)
ProductVersionsFixed in
libssh/libssh≥ 0.10.0, < 0.11.20.11.2
redhat/openshift_container_platformall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (3)
EPSS history
Timeline
  • 04 JUL 08:16Z
    Libssh: double free vulnerability in libssh key export functions
    cvelistv5