GHSA-39mw-228p-wr6v

GHSA-39mw-228p-wr6v PUBLISHED CVSS 3.0999999046325684 LOW

Record from GitHub Advisory Database · Published September 9, 2025

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

Risk scores

CVSS 3.1

3.0999999046325684

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Timeline

Sep 9, 2025 CVE Published
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-39mw-228p-wr6v
vulnetix vdb fixes GHSA-39mw-228p-wr6v

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-39mw-228p-wr6v/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →