Back Linuxsecurity Ubuntu 20.04 LTS libssh Important DDoS Risks USN-8051-2 CVE-2025
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in libssh. Software Description: - libssh: A tiny C SSH library Details: USN-8051-1 fixed vulnerabilities in libssh. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that libssh clients incorrectly handled the key exchange process. A remote attacker could possibly use this issue to cause libssh clients to crash, resulting in a denial of service. (CVE-2025-8277) It was discovered that the libssh SCP client incorrectly sanitized paths received from servers. A remote attacker could use this issue to cause libssh SCP clients to overwrite files outside of the working directory and possibly execute arbitrary code. (CVE-2026-0964) It was discovered that libssh incorrectly handled parsing configuration
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in libssh. Software Description: - libssh: A tiny C SSH library Details: USN-8051-1 fixed vulnerabilities in libssh. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that libssh clients incorrectly handled the key exchange process. A remote attacker could possibly use this issue to cause libssh clients to crash, resulting in a denial of service. (CVE-2025-8277) It was discovered that the libssh SCP client incorrectly sanitized paths received from servers. A remote attacker could use this issue to cause libssh SCP clients to overwrite files outside of the working directory and possibly execute arbitrary code. (CVE-2026-0964) It was discovered that libssh incorrectly handled parsing configuration
The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS libssh-4 0.9.3-2ubuntu2.5+esm3 Available with Ubuntu Pro Ubuntu 18.04 LTS libssh-4 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6 Available with Ubuntu Pro Ubuntu 16.04 LTS libssh-4 0.6.3-4.3ubuntu0.6+esm4 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS libssh-4 0.9.3-2ubuntu2.5+esm3 Available with Ubuntu Pro Ubuntu 18.04 LTS libssh-4 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6 Available with Ubuntu Pro Ubuntu 16.04 LTS libssh-4 0.6.3-4.3ubuntu0.6+esm4 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
CVE-2025-8277, CVE-2026-0964, CVE-2026-0965, CVE-2026-0966, CVE-2026-0967, CVE-2026-0968
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
