CVE-2025-5449: Libssh SFTP Server DOS Vulnerability

CVE-2025-5449 Overview

CVE-2025-5449 is an integer overflow vulnerability in the Secure File Transfer Protocol (SFTP) server message decoding logic of libssh. The flaw stems from an incorrect packet length check that permits an integer overflow when the server processes large payload sizes on 32-bit systems. The overflow leads to a failed memory allocation and crashes the server process, producing a denial of service condition. The issue affects libssh versions 0.11.0 and 0.11.1 and is tracked under [CWE-190] Integer Overflow or Wraparound.

Critical Impact
An authenticated remote attacker can crash SFTP server processes built on vulnerable libssh versions running on 32-bit platforms, interrupting file transfer services.

Affected Products

libssh 0.11.0
libssh 0.11.1
Applications and services embedding libssh SFTP server functionality on 32-bit systems

Discovery Timeline

2025-07-25 - CVE-2025-5449 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2025-5449

Vulnerability Analysis

The vulnerability resides in the SFTP server message decoding routine within libssh. When the server parses an incoming SFTP packet, it validates the declared payload length before allocating a buffer. On 32-bit systems, the length arithmetic can wrap around because the check does not account for the fixed overhead added during allocation. A crafted large payload causes the computed size to overflow a 32-bit integer, yielding an undersized or impossible allocation request.

The allocation subsequently fails and the server process terminates, breaking any SFTP sessions served by the affected daemon. Because libssh is widely embedded in third-party applications, the impact extends to any software that exposes an SFTP server built on the affected versions.

Root Cause

The root cause is an incorrect packet length check that allows arithmetic on a user-controlled payload size to exceed the width of a 32-bit integer. The decoder trusts the resulting value when requesting memory, violating safe integer handling practices described in [CWE-190].

Attack Vector

Exploitation requires network access to the SFTP service and a valid authenticated session, as reflected in the CVSS attack vector. After authentication, the attacker sends an SFTP message with a crafted large payload length that triggers the overflow during decoding. The vulnerability does not disclose data or allow code execution; the impact is limited to availability loss on 32-bit builds.

No exploitation code example is published. See the libssh CVE-2025-5449 Advisory for the vendor's technical description.

Detection Methods for CVE-2025-5449

Indicators of Compromise

Unexpected crashes or restarts of SFTP server processes linked against libssh 0.11.0 or 0.11.1 on 32-bit hosts.
Core dumps or logs showing memory allocation failures during SFTP packet decoding.
Repeated authenticated SFTP sessions from a single source immediately followed by service termination.

Detection Strategies

Inventory systems to identify SFTP services built on vulnerable libssh versions, prioritizing 32-bit deployments.
Monitor process supervision tools (systemd, supervisord) for abnormal restart counts on SSH or SFTP daemons.
Correlate authentication logs with service crash events to identify a specific session preceding each failure.

Monitoring Recommendations

Enable verbose SFTP and SSH logging to capture session identifiers associated with abnormal disconnects.
Forward SSH daemon logs and process crash telemetry to a centralized analytics platform for correlation.
Alert on repeated SFTP session initiations followed by daemon crashes within short time windows.

How to Mitigate CVE-2025-5449

Immediate Actions Required

Upgrade libssh to a fixed release incorporating the patches referenced in the vendor advisory.
Rebuild and redeploy any application that statically links or vendors libssh 0.11.0 or 0.11.1.
Restrict SFTP access to trusted authenticated users through network segmentation and firewall rules until patches are applied.

Patch Information

The libssh project addressed the issue in the stable-0.11 branch through multiple commits, including 261612179, 3443aec9, 5504ff40, 78485f44, and f79ec51b. Distribution-specific advisories such as the Red Hat CVE-2025-5449 Advisory provide packaged updates for supported platforms.

Workarounds

Deploy affected services on 64-bit builds where the integer overflow condition is not reachable with practical payload sizes.
Limit SFTP access to authenticated users with minimum necessary privileges and enforce rate limiting on new sessions.
Place SFTP services behind a bastion host or VPN to reduce exposure to untrusted authenticated clients.

bash

# Verify installed libssh version on Linux systems
ldconfig -p | grep libssh
rpm -q libssh   # Red Hat / Fedora
dpkg -s libssh4 # Debian / Ubuntu