libssh
12 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-3731 | 0.11.0 ; 0.11.1 ; 0.11.2 ; … | libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds | MEDIUM 6.9 | 0.7 % | ||
| CVE-2025-8277 | 0.6.0 – < 0.11.3 | Libssh: memory exhaustion via repeated key exchange in libssh | LOW 3.1 | 0.4 % | ||
| CVE-2025-4877 | < 0.11.2 | Libssh: write beyond bounds in binary to base64 conversion functions | MEDIUM 4.5 | 0.2 % | ||
| CVE-2025-5449 | 0.11.0 – 0.11.1 | Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service | MEDIUM 6.5 | 1.0 % | ||
| CVE-2025-8114 | < 0.11.3 | Libssh: null pointer dereference in libssh kex session id calculation | MEDIUM 4.7 | 0.3 % | ||
| CVE-2025-4878 | < 0.11.2 | Libssh: use of uninitialized variable in privatekey_from_file() | LOW 3.6 | 0.2 % | ||
| CVE-2025-5987 | 0.10.0 – < 0.11.2 | Libssh: invalid return code for chacha20 poly1305 with openssl backend | HIGH 8.1 | 1.7 % | ||
| CVE-2025-5318 | < 0.11.2 | Libssh: out-of-bounds read in sftp_handle() | HIGH 8.1 | 1.8 % | ||
| CVE-2023-3603 | | Processing sftp server read may cause null dereference | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-2283 | libssh-2 | A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signatur | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-1667 | libssh-2 | A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cau | MEDIUM 6.5 | 1.3 % | ||
| CVE-2021-3634 | libssh 0.9.6 | A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the se | MEDIUM 6.5 | 4.7 % |