CVE-2025-5987

What it actually does

In libssh using ChaCha20 with OpenSSL, heap exhaustion produces an OpenSSL error code that aliases SSH_OK; the error goes undetected and libssh proceeds with a partially initialized cipher context, yielding undefined behavior that can corrupt confidentiality or integrity or cause crashes.

Why it matters to the business

Systems that rely on libssh for encrypted remote access face elevated risk of data exposure, tampering, or sudden outages; the issue affects multiple Harbor container images and any downstream applications using the vulnerable libssh build.

How an attack unfolds

An attacker forces heap exhaustion during ChaCha20 cipher initialization over an SSH connection; because the OpenSSL error is misinterpreted as success, libssh accepts the malformed context and subsequent packet processing triggers undefined behavior that the attacker can leverage for information disclosure or denial of service.

How to fix it

Upgrade libssh to commit dff6c0821ed54f6fbf5b755af43f54cbb723b1b1 or later; for the listed Harbor-FIPS images update to version 2.11.2-r15 or newer. Disable ChaCha20 in sshd_config as a temporary mitigation if immediate patching is not feasible.

How to confirm the fix worked

Confirm package versions match the fixed releases, run targeted regression tests that simulate heap exhaustion during ChaCha20 cipher setup, and verify that OpenSSL errors are now correctly surfaced as SSH errors.

Typical attack path

1. Establish an SSH session requesting the ChaCha20 cipher
2. Induce heap pressure to trigger OpenSSL allocation failure
3. Send crafted packets that exercise the partially initialized context
4. Observe or manipulate resulting undefined behavior for data access or crash

How to detect it

Search application and system logs for libssh processes terminating abnormally during SSH handshakes that negotiated ChaCha20; correlate with memory-pressure indicators or failed allocation messages from OpenSSL.

What your security team should do

• Apply the listed fixed versions to all affected Harbor and libssh deployments within the next maintenance window
• Review sshd_config files to ensure ChaCha20 is not the sole enabled cipher
• Increase monitoring of SSH-related crashes and memory-pressure events for the next 30 days given the rising EPSS trend