CVE catalog

CVE-2025-15661

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle

[CVE catalog]

Severity
High · CVSS 8.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibssh2sid1.11.1-6fixed
Debianlibssh2forky1.11.1-6fixed
Debianlibssh2trixie1.11.1-1+deb13u2fixed
Debianlibssh2trixie-security1.11.1-1+deb13u1fixed
Debianlibssh2bookworm1.10.0-3vulnerable
Debianlibssh2bookworm-security1.10.0-3+deb12u1fixed
Cpelibssh2Not reported1.11.0-4.1ubuntu0.24.04.2fixed
Cpelibssh2-1-devNot reported1.11.0-4.1ubuntu0.24.04.2fixed
Cpelibssh2-1t64Not reported1.11.0-4.1ubuntu0.24.04.2fixed
Cpelibssh2Not reportedNot reportedvulnerable
Cpelibssh2Not reportedNot reportedunknown
Cpelibssh2Not reportedNot reportedunknown
Ubuntulibssh2pro1.8.0-2.1build1vulnerable
Ubuntulibssh2pro1.8.0-2.1ubuntu0.1vulnerable
Ubuntulibssh2pro1.8.0-2.1ubuntu0.1+esm1vulnerable
Ubuntulibssh222.041.9.0-3vulnerable
Ubuntulibssh222.041.10.0-2vulnerable
Ubuntulibssh222.041.10.0-2build1vulnerable
Ubuntulibssh222.041.10.0-3vulnerable
Ubuntulibssh222.041.10.0-3ubuntu0.1vulnerable
Ubuntulibssh224.041.11.0-2vulnerable
Ubuntulibssh224.041.11.0-3vulnerable
Ubuntulibssh224.041.11.0-4vulnerable
Ubuntulibssh224.041.11.0-4.1build1vulnerable
Ubuntulibssh224.041.11.0-4.1build2vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.1vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.2fixed
Ubuntulibssh225.101.11.1-1vulnerable
Ubuntulibssh225.101.11.1-1build1vulnerable
Ubuntulibssh225.101.11.1-1ubuntu0.25.10.1vulnerable
Ubuntulibssh225.101.11.1-1ubuntu0.25.10.2fixed
Ubuntulibssh226.041.11.1-1build1vulnerable
Ubuntulibssh226.041.11.1-1build2vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.1vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.2fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp4-espos1.11.0-150000.4.35.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp4-ltss1.11.0-150000.4.35.1fixed
Suselibssh2_orglinux enterprise server 15 sp4-ltss1.11.0-150000.4.35.1fixed
Alpinelibssh23.211.11.1-r3fixed
Alpinelibssh23.221.11.1-r3fixed
Alpinelibssh23.231.11.1-r4fixed
Alpinelibssh23.241.11.1-r4fixed
Alpinerust3.241.96.1-r0fixed
Suselibssh2_orglinux micro 6.01.11.0-4.1fixed
Suselibssh2_orglinux enterprise server 16.01.11.1-160000.5.1fixed
Suselibssh2_orglinux enterprise server for sap applications 16.01.11.1-160000.5.1fixed
Suselibssh2_orglinux enterprise server 16.01.11.1-160000.5.1fixed
Suselibssh2_orglinux enterprise server for sap applications 16.01.11.1-160000.5.1fixed
Suselibssh2_orglinux micro 6.11.11.0-slfo.1.1_2.1fixed
Opensuselibssh2_orgleap 16.01.11.1-160000.5.1fixed
Suselibssh2_orglinux micro 6.21.11.1-160000.5.1fixed
Suselibssh2_orglinux enterprise module for basesystem 15 sp71.11.0-150600.20.6.1fixed
Suselibssh2_orglinux enterprise server 15 sp6-ltss1.11.0-150600.20.6.1fixed
Suselibssh2_orglinux enterprise server for sap applications 15 sp61.11.0-150600.20.6.1fixed
Suselibssh2_orglinux enterprise server 12 sp5-ltss1.11.0-29.18.1fixed
Suselibssh2_orglinux enterprise server ltss extended security 12 sp51.11.0-29.18.1fixed
Suselibssh2_orglinux enterprise micro 5.31.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise micro 5.41.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise micro 5.51.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp4-espos1.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp4-ltss1.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp5-espos1.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp5-ltss1.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise server 15 sp4-ltss1.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise server 15 sp5-ltss1.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise server for sap applications 15 sp41.11.0-150200.9.8.1fixed
Suselibssh2_orglinux enterprise server for sap applications 15 sp51.11.0-150200.9.8.1fixed
Ubuntulibssh224.041.11.0-2vulnerable
Ubuntulibssh224.041.11.0-3vulnerable
Ubuntulibssh224.041.11.0-4vulnerable
Ubuntulibssh224.041.11.0-4.1build1vulnerable
Ubuntulibssh224.041.11.0-4.1build2vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.1vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.2fixed
Ubuntulibssh225.101.11.1-1vulnerable
Ubuntulibssh225.101.11.1-1build1vulnerable
Ubuntulibssh225.101.11.1-1ubuntu0.25.10.1vulnerable
Ubuntulibssh225.101.11.1-1ubuntu0.25.10.2fixed
Ubuntulibssh226.041.11.1-1build1vulnerable
Ubuntulibssh226.041.11.1-1build2vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.1vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.2fixed
Opensuselibssh2_orgtumbleweed1.11.1-3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibssh2sourcesid1.11.1-4not yet assignedNot reported[1140401]
Debianlibssh2sourceforky1.11.1-4not yet assignedNot reported[1140401]
Debianlibssh2sourcetrixie1.11.1-1+deb13u1not yet assignedNot reported[1140401]
Debianlibssh2sourcebookworm1.10.0-3+deb12u1not yet assignedNot reported[1140401]
Cpelibssh2cpeNot reported1.11.0-4.1ubuntu0.24.04.2Not reportedNot reportedNot reported
Cpelibssh2-1-devcpeNot reported1.11.0-4.1ubuntu0.24.04.2Not reportedNot reportedNot reported
Cpelibssh2-1t64cpeNot reported1.11.0-4.1ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntulibssh2deb24.041.11.0-4.1ubuntu0.24.04.2Not reportedUBUNTU-CVE-2025-15661Not reported
Ubuntulibssh2deb25.101.11.1-1ubuntu0.25.10.2Not reportedUBUNTU-CVE-2025-15661Not reported
Ubuntulibssh2deb26.041.11.1-1ubuntu0.26.04.2Not reportedUBUNTU-CVE-2025-15661Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp4-espos1.11.0-150000.4.35.1Not reportedSUSE-SU-2026:4095-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp4-ltss1.11.0-150000.4.35.1Not reportedSUSE-SU-2026:4095-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp4-ltss1.11.0-150000.4.35.1Not reportedSUSE-SU-2026:4095-1Not reported
Alpinelibssh2apk3.211.11.1-r3Not reportedALPINE-CVE-2025-15661Not reported
Alpinelibssh2apk3.221.11.1-r3Not reportedALPINE-CVE-2025-15661Not reported
Alpinelibssh2apk3.231.11.1-r4Not reportedALPINE-CVE-2025-15661Not reported
Alpinelibssh2apk3.241.11.1-r4Not reportedALPINE-CVE-2025-15661Not reported
Alpinerustapk3.241.96.1-r0Not reportedALPINE-CVE-2025-15661Not reported
Suselibssh2_orgrpmlinux micro 6.01.11.0-4.1Not reportedSUSE-SU-2026:23245-1Not reported
Suselibssh2_orgrpmlinux enterprise server 16.01.11.1-160000.5.1Not reportedSUSE-SU-2026:23225-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 16.01.11.1-160000.5.1Not reportedSUSE-SU-2026:23225-1Not reported
Suselibssh2_orgrpmlinux enterprise server 16.01.11.1-160000.5.1Not reportedSUSE-SU-2026:23214-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 16.01.11.1-160000.5.1Not reportedSUSE-SU-2026:23214-1Not reported
Suselibssh2_orgrpmlinux micro 6.11.11.0-slfo.1.1_2.1Not reportedSUSE-SU-2026:23187-1Not reported
Opensuselibssh2_orgrpmleap 16.01.11.1-160000.5.1Not reportedOPENSUSE-SU-2026:21549-1Not reported
Suselibssh2_orgrpmlinux micro 6.21.11.1-160000.5.1Not reportedSUSE-SU-2026:23049-1Not reported
Suselibssh2_orgrpmlinux enterprise module for basesystem 15 sp71.11.0-150600.20.6.1Not reportedSUSE-SU-2026:3541-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp6-ltss1.11.0-150600.20.6.1Not reportedSUSE-SU-2026:3541-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 15 sp61.11.0-150600.20.6.1Not reportedSUSE-SU-2026:3541-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp5-ltss1.11.0-29.18.1Not reportedSUSE-SU-2026:3525-1Not reported
Suselibssh2_orgrpmlinux enterprise server ltss extended security 12 sp51.11.0-29.18.1Not reportedSUSE-SU-2026:3525-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.31.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.41.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.51.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp4-espos1.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp4-ltss1.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp5-espos1.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp5-ltss1.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp4-ltss1.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp5-ltss1.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 15 sp41.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 15 sp51.11.0-150200.9.8.1Not reportedSUSE-SU-2026:3526-1Not reported
Ubuntulibssh2deb24.041.11.0-4.1ubuntu0.24.04.2Not reportedUSN-8486-1Not reported
Ubuntulibssh2deb25.101.11.1-1ubuntu0.25.10.2Not reportedUSN-8486-1Not reported
Ubuntulibssh2deb26.041.11.1-1ubuntu0.26.04.2Not reportedUSN-8486-1Not reported
Opensuselibssh2_orgrpmtumbleweed1.11.1-3.1Not reportedOPENSUSE-SU-2026:11109-1Not reported

[Debian bug #1140401]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libssh2-1]Affected

    Source package: [libssh2]

    Details (2)

    • 1.10.0-3+b1 · amd64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

    • 1.10.0-3+b1 · arm64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

  • [libssh2-1-dev]Affected

    Source package: [libssh2]

    Details (2)

    • 1.10.0-3+b1 · amd64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

    • 1.10.0-3+b1 · arm64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

[openSUSE Tumbleweed]

  • [libssh2-1]Unknown

    Source package: [libssh2_org]

    Details (1)

    • 1.11.1-4.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.11.1-3.1

      Version impact unknown

      nvd · libssh2_org · opensuse · tumbleweed

  • [libssh2-1-32bit]Unknown

    Source package: [libssh2_org]

    Details (1)

    • 1.11.1-4.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.11.1-3.1

      Version impact unknown

      nvd · libssh2_org · opensuse · tumbleweed

  • [libssh2-devel]Unknown

    Source package: [libssh2_org]

    Details (1)

    • 1.11.1-4.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.11.1-3.1

      Version impact unknown

      nvd · libssh2_org · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libssh2-1-dev]Fixed

    Source package: [libssh2]

    Details (4)

    • 1.11.1-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

  • [libssh2-1t64]Fixed

    Source package: [libssh2]

    Details (4)

    • 1.11.1-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.11.1-1+deb13u1

      nvd · libssh2 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]