VulnerabilityDeferred

CVE-2025-8277

This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

LOW 3.1EPSS 0.40%

Does this matter?

Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

CVSS 3.1: 3.1 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.40% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-401
Source: secalert@redhat.com

References

https://access.redhat.com/errata/RHSA-2026:18683
https://access.redhat.com/security/cve/CVE-2025-8277
https://bugzilla.redhat.com/show_bug.cgi?id=2383888
https://www.libssh.org/security/advisories/CVE-2025-8277.txt

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.