How severe is CVE-2025-5987?

CVE-2025-5987 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-5987 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-5987?

CVE-2025-5987 affects Libssh. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-5987?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-5987 have an EU (EUVD) identifier?

Yes. CVE-2025-5987 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-20227.

When was CVE-2025-5987 published?

CVE-2025-5987 was published on 2025-07-07 and last updated on 2026-06-30.

CVE-2025-5987

CVE-2025-5987 is a high-severity vulnerability in Libssh with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-393.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 1% (70th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-20227
Weakness: CWE-393
Affected product: Libssh
Published: 2025-07-07
Last modified: 2026-06-30

Description

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

Frequently asked questions

What is CVE-2025-5987?: A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
How severe is CVE-2025-5987?: CVE-2025-5987 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-5987 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-5987?: CVE-2025-5987 affects Libssh. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-5987?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-5987 have an EU (EUVD) identifier?: Yes. CVE-2025-5987 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-20227.
When was CVE-2025-5987 published?: CVE-2025-5987 was published on 2025-07-07 and last updated on 2026-06-30.

References

Affected products (1)

cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*

More vulnerabilities in Libssh

CVE-2018-10933 — Critical (CVSS 9.1): A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client…
CVE-2019-14889 — High (CVSS 8.8): A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh…
CVE-2026-0966 — High (CVSS 8.2): A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing…
CVE-2025-5318 — High (CVSS 8.1): A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the…
CVE-2025-14821 — High (CVSS 7.8): A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH…
CVE-2015-3146 — High (CVSS 7.5): The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not…

All CVEs affecting Libssh →

Other CWE-393 vulnerabilities

CVE-2026-9058 — Critical (CVSS 9.3): Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e.…
CVE-2024-49117 — High (CVSS 8.8): Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-53092 — High (CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg ==…
CVE-2025-24531 — Medium (CVSS 6.7): In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as…

Browse all CWE-393 vulnerabilities →