CVE-2025-8277

LowCVSS 3.1/10Last modified Oct 18, 2026

Description

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-401

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-82799.8Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query executionCVE-2025-82805.8The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back CVE-2025-82817.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a ReflCVE-2025-82823.5The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allowCVE-2025-82833.7A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being reCVE-2025-82849.8By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow CVE-2025-82855.3Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel suCVE-2025-82869.3The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurCVE-2025-82897.5The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 viCVE-2025-82906.4The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and incCVE-2025-82914.3The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be usedCVE-2025-82928.8Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via