CVE-2025-5449 is a denial-of-service vulnerability in libssh's SFTP server message decoding logic, affecting libssh products. The flaw stems from an integer overflow on 32-bit systems during an incorrect packet length check with large payloads. This can lead to memory allocation failures and server crashes. With a CVSS score of 6.5 (Medium), it can be exploited remotely with low complexity and privileges, resulting in high availability impact. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.11.0CPE matchmatch criteria | cpe:2.3:a:libssh:libssh:0.11.0:*:*:*:*:*:*:* | ||
0.11.1CPE matchmatch criteria | cpe:2.3:a:libssh:libssh:0.11.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
HP ThinPro 8.1 SP8 Security Updates
Oct 27, 2025HP ThinPro 8.1 SP8 Security Updates
Oct 27, 2025HP ThinPro 8.1 SP8 Security Updates
Oct 27, 2025libssh: Integer Overflow in libssh SFTP Server Packet Length Validation Leading to Denial of Service
Jun 24, 2025