CVE-2025-5372: Libssh

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

Affected products

• Libssh Libssh: before 0.11.2 (fixed in 0.11.2)
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only; version 9.0 only; version 10.0 only
• Red Hat Openshift Container Platform: version 4.0 only

Published 2025-07-04. Last modified 2026-09-01.