CVE-2025-15661: libssh2 Out-of-Bounds Heap Read in SFTP Symlink Handling

Technical summary

The vulnerability resides in the sftp_symlink() function within src/sftp.c. When libssh2 processes an SSH_FXP_NAME response packet during READLINK or REALPATH operations, it fails to validate that the link_len value advertised in the response matches the actual data present in the packet buffer. An attacker-controlled SSH server can supply a link_len larger than the genuine packet payload. The code then performs a memcpy operation without first confirming sufficient buffer data is available, resulting in an out-of-bounds heap read of up to (target_len - 1) bytes. This exposes adjacent heap memory contents and may trigger a segmentation fault. The fix, implemented in commit 2dae302, adds proper packet buffer boundary validation before the memory copy operation.

Business impact

Organizations relying on libssh2 for SFTP client functionality face two concurrent risks: potential disclosure of sensitive application data or keys resident in heap memory, and availability disruption through denial of service. The exposure is particularly acute in automated environments (CI/CD pipelines, remote backups, configuration management tools) where SFTP clients connect to external or less-trusted servers. Confidentiality impact is rated low because heap contents are not predictable; availability impact is high because a crash terminates the connection and may interrupt critical automation workflows. The medium CVSS score (6.5) reflects the network-only attack surface offset by the requirement for an active malicious SSH server.

Affected systems

Any application or system statically or dynamically linked against libssh2 versions 1.11.1 and earlier is vulnerable if that application uses SFTP symlink operations (READLINK or REALPATH). This includes but is not limited to Git clients with SSH support, SCP/SFTP utilities, configuration management agents, and backup solutions. Systems using libssh2 for non-SFTP SSH operations (pure SSH shells or port forwarding) or those with SFTP operations not involving symlink calls may have lower practical risk, though the underlying flaw remains present in the library itself.

Exploitability

Exploitation requires control or compromise of the SSH server to which the victim's application connects, or successful man-in-the-middle positioning between client and server. The attacker must craft a malicious SSH_FXP_NAME packet response. No user interaction is needed, and the attack can be fully automated. However, this is not a situation where random internet-facing servers are at risk—the attacker must intercept or control a specific, trusted SSH endpoint. Public availability of working exploit code is not typical for heap over-reads because reliable memory disclosure and crash conditions vary by application memory layout; the KEV catalog has not marked this as actively exploited.

Remediation

Upgrade libssh2 to a version containing commit 2dae302 or later. Verify the specific patch version with your vendor or release notes, as version numbering varies across distributions. For systems unable to upgrade immediately, isolate SFTP client connections to known, administratively-controlled SSH servers and enforce TLS/SSH channel security (certificate pinning, known-hosts verification) to reduce the likelihood of successful man-in-the-middle attacks. Applications should also implement SFTP operation timeouts and graceful error handling for unexpected crashes.

Patch guidance

Contact your distribution or software vendor for libssh2 updates containing commit 2dae302. Debian, Red Hat, Ubuntu, and other package maintainers will publish patched versions; check your vendor's security advisory. If you maintain local builds, pull the latest libssh2 source and verify the commit hash. Test patched builds against your SFTP workloads (particularly READLINK and REALPATH operations) in a staging environment before production deployment. No configuration changes or workarounds can fully mitigate the vulnerability—patching the library is mandatory for affected versions.

Detection guidance

Monitor for unexpected crashes or restarts of applications using libssh2, particularly those with SFTP workloads, especially after connections to external SSH servers. Review application logs for SFTP operation errors or timeouts. Network intrusion detection systems can be configured to flag malformed SSH_FXP_NAME packets with anomalously large link_len values during symlink operations, though this requires inspection of the SSH protocol layer (typically seen in high-interaction honeypots or detailed SSH protocol analysis). Inventory all systems and applications linked against libssh2 and cross-reference against your libssh2 version to identify exposure.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized for patching within 30 days because it affects a widely-used cryptographic library and has tangible impact on both confidentiality and availability. Applications in automation-heavy environments (CI/CD, deployment pipelines, backup systems) are at elevated risk due to frequent SFTP operations. The barrier to exploitation (control of or MITM on the target SSH server) limits urgency compared to unauthenticated remote code execution, but organizations should not delay patching indefinitely.

Risk score, explained

CVSS 6.5 (MEDIUM) is justified by: Network-only attack vector (no local access needed), no user interaction, but high complexity in achieving man-in-the-middle or server compromise; partial confidentiality impact (heap memory disclosure is possible but unpredictable and not easily weaponized to steal specific secrets); and high availability impact (crash of SFTP client processes). The score does not account for the widespread use of libssh2 or the criticality of SFTP in many automation workflows; context-specific risk may warrant internal elevation based on your organization's reliance on SFTP automation.

Frequently asked questions