---
id: CVE-2025-8277
title: >-
  A flaw was found in libssh's handling of key exchange (KEX) processes when a
  client repeatedly sends incorrect KEX guesses
summary: >-
  A flaw was found in libssh's handling of key exchange (KEX) processes when a
  client repeatedly sends incorrect KEX guesses. The library fails to free
  memory during these rekey operations, which can gradually exhaust system
  memory. This i…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
published: '2025-09-09'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8277'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:18683'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-8277'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2383888'
    label: secalert@redhat.com
  - url: 'https://www.libssh.org/security/advisories/CVE-2025-8277.txt'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00402
epssPercentile: 0.3421
ingestedAt: '2026-06-29T13:24:34.554Z'
---

## Overview

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.