Libssh: incorrect return code handling in ssh_kdf() in libssh

🗓️ 03 Mar 2026 00:00:00Reported by Broadcom Security ResponseType

Libssh misinterprets ssh_kdf return values with OpenSSL below three, risking uninitialized keys and SSH session security.

Reporter	Title	Published	Views	Family All 162
IBM Security Bulletins	Security Bulletin: Muliple security vulnerabilities found in IBM CICS TX Standard.	22 Apr 202614:23	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.	25 Feb 202617:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.17.0 shipped with IBM Cloud Pak for Business Automation iFixes for April 2026	27 May 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libssh library (CVE-2025-5372) affects Power HMC.	6 Apr 202606:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	9 Feb 202614:45	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities found in the Red Hat Universal Minimal Base Image shipped with CICS Transaction Gateway for Multiplatforms	26 Jan 202609:58	–	ibm
ATTACKERKB	CVE-2025-5372	4 Jul 202506:15	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0189: libssh (ALINUX3-SA-2025:0189)	3 Dec 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : libssh (ALSA-2025:21977)	3 Dec 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: libssh (CVE-2025-5372)	19 Jul 202500:00	–	nessus

Vulners

Node

03 Mar 2026 19:49Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15 - 8.8

EPSS0.00246

SSVC