libssh

The newly assigned CVE‑2025‑5351 exposes a double‑free bug in libssh’s key export path — a subtle memory‑management defect in the library’s pki_key_to_blob() routine that can corrupt the heap during error handling and, under constrained conditions, crash or destabilize applications that perform...

Microsoft’s short advisory language — that “Azure Linux includes this open‑source library and is therefore potentially affected” — is an accurate, product‑scoped attestation, but it is not a categorical statement that Azure Linux is the only Microsoft product that could ever contain the...

A null-pointer dereference in libssh’s key-exchange (KEX) session‑ID calculation has been publicly disclosed as CVE-2025-8114, and upstream maintainers, distribution security teams, and third‑party trackers classify the flaw as an availability vulnerability that can crash SSH clients or servers...

Libssh contains a memory‑exhaustion defect in its key‑exchange handling (CVE‑2025‑8277) that can, under repeated rekeying attempts with incorrect KEX guesses, leak ephemeral key material and gradually exhaust client memory — a low‑severity but practical availability risk for any software that...