CVE-2025-5351: Libssh: double free vulnerability in libssh key export functions

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-04 · updated 2026-09-01
Weakness: CWE-415

Description

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

Affected products

libssh: from 0.10.0 before 0.11.2 — fixed in 0.11.2
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.18: 4.0

How to fix

Upgrade to a fixed version: libssh 0.11.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-5351 or the next vulnerability affects your stack