CVE-2025-46806: sslh Denial of Service Vulnerability

CVE-2025-46806 Overview

CVE-2025-46806 is a use of out-of-range pointer offset vulnerability [CWE-823] in sslh, a protocol demultiplexer that shares a single TCP port among multiple services such as SSH, HTTPS, and OpenVPN. The flaw affects sslh versions prior to 2.2.4 and can trigger a denial of service on certain architectures. An unauthenticated remote attacker can exploit the issue over the network without user interaction. The maintainer resolved the defect in the sslh v2.2.4 release.

Critical Impact
Remote attackers can crash sslh instances without authentication, disrupting all services multiplexed behind the shared listening port.

Affected Products

sslh versions before 2.2.4
Linux distributions packaging vulnerable sslh builds, including SUSE (see SUSE Bug Report CVE-2025-46806)
Systems on architectures where the out-of-range pointer offset produces a crash rather than benign behavior

Discovery Timeline

2025-06-02 - CVE-2025-46806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46806

Vulnerability Analysis

The defect is categorized under [CWE-823: Use of Out-of-range Pointer Offset]. sslh inspects the initial bytes of a client connection to determine which backend protocol should receive the traffic. During this probing logic, the code computes a pointer offset that can fall outside the bounds of the allocated buffer. On architectures that enforce strict pointer arithmetic or where the resulting address maps to unmapped memory, dereferencing the pointer terminates the process.

The outcome is a denial of service against the multiplexer. Because sslh fronts multiple services on a shared port, a single crash removes access to every backend protocol behind it. The attack requires only a crafted TCP payload sent to the listening port.

Root Cause

The root cause lies in insufficient bounds validation before applying arithmetic to a buffer pointer inside the protocol probe routines. When the input length or field encoding falls outside expected values, the computed offset exceeds the buffer, producing undefined behavior. Architecture-specific memory layout and alignment enforcement determine whether the outcome is a silent misread or a fatal fault.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted TCP handshake to any port where sslh listens. The malformed payload steers the demultiplexer into the vulnerable probe path, triggering the out-of-range pointer offset and crashing the daemon. Repeated connections sustain the outage. Full technical context is available in the upstream v2.2.4 release notes.

Detection Methods for CVE-2025-46806

Indicators of Compromise

Unexpected termination of the sslh process, with core dumps or SIGSEGV entries in journalctl -u sslh or /var/log/syslog.
Repeated short-lived TCP connections to the sslh listening port from a single or small set of source addresses immediately preceding a crash.
Loss of availability for multiple backend services (SSH, HTTPS, OpenVPN) that share the sslh front-end port.

Detection Strategies

Monitor process supervisors (systemd, runit) for abnormal restart counts on the sslh unit.
Alert on kernel messages referencing segmentation faults tied to the sslh binary via dmesg or auditd.
Correlate connection floods against the shared port with service unavailability windows using network telemetry.

Monitoring Recommendations

Ingest sslh service logs and host crash telemetry into a centralized analytics platform for cross-host correlation.
Track version inventory of the sslh package across Linux hosts and flag any instance below 2.2.4.
Baseline connection rates to the sslh listener and alert on statistical deviations that may indicate probing or exploitation attempts.

How to Mitigate CVE-2025-46806

Immediate Actions Required

Upgrade sslh to version 2.2.4 or later on all affected hosts.
Apply distribution-specific security updates once available; SUSE users should track the SUSE bug report.
Configure the service manager to automatically restart sslh on failure to reduce outage duration while patches propagate.

Patch Information

The upstream maintainer released the fix in sslh v2.2.4. Package maintainers for major Linux distributions are shipping backported fixes; verify with the distribution's advisory tracker before relying on the installed version.

Workarounds

Restrict access to the sslh listening port via firewall rules or a reverse proxy that filters malformed handshakes.
Use iptables or nftables rate-limiting to blunt repeated crash-inducing connection attempts.
Temporarily front sslh with a hardened TLS terminator or run backend services directly on dedicated ports if patching is delayed.

bash

# Verify installed sslh version and upgrade on Debian-based systems
sslh --version
sudo apt update && sudo apt install --only-upgrade sslh

# Rate-limit new connections to the sslh listener (example: TCP 443)
sudo nft add rule inet filter input tcp dport 443 ct state new limit rate 20/second accept