CVE-2025-5449
Last modified
CVE-2025-5449 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Libssh | Libssh | 0.11.0 |
| Libssh | Libssh | 0.11.1 |
References
- https://access.redhat.com/security/cve/CVE-2025-5449Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2369705Issue Tracking, Third Party Advisory
- https://www.libssh.org/security/advisories/CVE-2025-5449.txtThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-5449?
How severe is CVE-2025-5449?
How do I fix CVE-2025-5449?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54484A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54485A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54486A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54487A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54488A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54489A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54490A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54491A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54492A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54493A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54494A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-54495A reflected cross-site scripting (xss) vulnerability exists …5.4
Are you affected by CVE-2025-5449?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST