CVE-2025-46807: sslh Denial of Service Vulnerability

CVE-2025-46807 Overview

CVE-2025-46807 is a resource exhaustion vulnerability in sslh, a protocol demultiplexer that allows multiple services such as HTTPS, SSH, and OpenVPN to share a single TCP port. The flaw stems from missing limits on resource allocation [CWE-770], allowing remote attackers to exhaust the file descriptors available to the sslh process. Once exhausted, sslh cannot accept new connections, denying service to legitimate users. The issue affects sslh versions before 2.2.4 and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can disable sslh connection multiplexing, blocking access to all backend services routed through the shared listening port.

Affected Products

sslh versions prior to 2.2.4
Linux distributions packaging vulnerable sslh builds (including SUSE)
Systems using sslh as a front-end multiplexer for SSH, HTTPS, OpenVPN, or other TCP services

Discovery Timeline

2025-06-02 - CVE-2025-46807 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-46807

Vulnerability Analysis

sslh listens on a single TCP port and forwards incoming connections to the appropriate backend based on initial protocol probing. To perform this probing, the daemon accepts each incoming connection and holds a file descriptor open while it reads the first bytes from the client to determine the protocol. The vulnerability allows an attacker to open many TCP connections to the sslh listener and either delay or never send protocol data. Because sslh does not enforce a meaningful cap on simultaneously pending connections or apply aggressive timeouts before version 2.2.4, the daemon accumulates open descriptors until the process hits its file descriptor limit. New connection attempts from legitimate users then fail, producing a denial of service against every service multiplexed behind sslh.

Root Cause

The root cause is improper allocation of resources without limits or throttling [CWE-770]. The pre-2.2.4 code path does not impose a bounded concurrency budget on half-open or probing connections, nor does it reclaim descriptors quickly enough when clients stall.

Attack Vector

Exploitation is unauthenticated and remote. An attacker only needs network reachability to the TCP port on which sslh listens. Repeatedly opening TCP connections without completing the protocol handshake is sufficient to saturate the descriptor pool.

No verified public proof-of-concept code is published. The exhaustion pattern is consistent with low-rate Slowloris-style connection holding rather than high-bandwidth flooding. See the GitHub Release v2.2.4 notes and the SUSE Bug Report CVE-2025-46807 for technical context.

Detection Methods for CVE-2025-46807

Indicators of Compromise

Sudden spike in established or half-open TCP connections to the sslh listening port from a small set of source IPs.
sslh log entries showing accept() failures or EMFILE / ENFILE errors when the descriptor limit is reached.
Backend services such as SSH or HTTPS becoming unreachable through sslh while the host itself remains responsive.

Detection Strategies

Monitor the file descriptor count of the sslh process via /proc/<pid>/fd and alert when usage approaches the configured ulimit -n.
Track connection state distribution with ss -s or netstat and flag abnormal SYN_RECV or idle ESTABLISHED counts on the multiplexer port.
Correlate failed client connection attempts to sslh with steady source IPs holding many concurrent sockets.

Monitoring Recommendations

Ingest sslh and kernel socket telemetry into a centralized logging or SIEM platform for time-series analysis.
Baseline normal concurrency on the multiplexer port and alert on sustained deviations.
Watch for repeated process restarts of sslh under systemd, which often follows descriptor exhaustion.

How to Mitigate CVE-2025-46807

Immediate Actions Required

Upgrade sslh to version 2.2.4 or later on all hosts running the multiplexer.
Restrict exposure of the sslh listener to trusted networks where operationally feasible.
Raise the process file descriptor limit only as a short-term cushion, not as a substitute for patching.

Patch Information

The fix is delivered in sslh2.2.4, available from the upstream project at GitHub Release v2.2.4. Distribution-specific advisories are tracked in the SUSE Bug Report CVE-2025-46807. Apply vendor packages where available rather than building from source to retain distribution-managed updates.

Workarounds

Place sslh behind a stateful firewall that rate-limits new TCP connections per source IP to the multiplexer port.
Use iptables or nftablesconnlimit rules to cap concurrent connections per client.
Configure aggressive TCP keepalive and short read timeouts in the sslh configuration to reclaim stalled descriptors faster.

bash

# Configuration example: cap concurrent connections per source IP using nftables
table inet filter {
    chain input {
        type filter hook input priority 0; policy accept;
        tcp dport 443 ct state new meter sslh_conn { ip saddr limit rate over 20/minute } drop
        tcp dport 443 ct count over 50 drop
    }
}