CVE-2025-8114
: null pointer dereference in libssh kex session id calculation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
: null pointer dereference in libssh kex session id calculation
A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.
Reserved 2025-07-24 | Published 2025-07-24 | Updated 2025-07-24 | Assigner redhat| 2025-07-24: | Reported to Red Hat. |
| 2025-07-24: | Made public. |
Red Hat would like to thank Jakub Jelen and Philippe Antoine for reporting this issue.
access.redhat.com/security/cve/CVE-2025-8114
bugzilla.redhat.com/show_bug.cgi?id=2383220 (RHBZ#2383220)
Support options
