CVE-2025-8114

MediumCVSS 4.7/10Last modified Nov 5, 2026

Description

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
——< 0.11.3
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—

References

Timeline

Published
Jul 24, 2025
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-81155.4A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability CVE-2025-81166.1PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will resulCVE-2025-81177.5PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset pasCVE-2025-81186.5PAD CMS implements weak client-side brute-force protection by utilizing two cookies:  login_count and login_timeout. Information about attemCVE-2025-81194.3PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which wCVE-2025-81209.8Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to uploaCVE-2025-81218.8Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks.CVE-2025-81228.8Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks.CVE-2025-81238.8A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been classified as critical. Affected is an unknown function of the file /CVE-2025-81248.8A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been declared as critical. Affected by this vulnerability is an unknown fuCVE-2025-81259.8A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been rated as critical. Affected by this issue is some unknown functionaliCVE-2025-81268.8A vulnerability classified as critical has been found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/user