---
id: CVE-2025-5449
title: A flaw was found in the SFTP server message decoding logic of libssh
summary: >-
  A flaw was found in the SFTP server message decoding logic of libssh. The
  issue occurs due to an incorrect packet length check that allows an integer
  overflow when handling large payload sizes on 32-bit systems. This issue leads
  to faile…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-190
vendor: libssh
product: libssh
affected:
  - libssh = 0.11.0
  - libssh = 0.11.1
published: '2025-07-25'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5449'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2025-5449'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2369705'
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4da
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=78485f446af9b30e37eb8f177b81940710d54496
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=f79ec51b7fd519dbc5737a7ba826e3ed093f6ceb
    label: secalert@redhat.com
  - url: 'https://www.libssh.org/security/advisories/CVE-2025-5449.txt'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00841
epssPercentile: 0.56389
ingestedAt: '2026-06-29T13:24:34.399Z'
---

## Overview

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

## Affected

- `libssh = 0.11.0`
- `libssh = 0.11.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.