JLSEC-2025-100

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-100.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-100.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2025-100
Upstream
Published
2025-10-19T18:40:48.457Z
Modified
2025-11-03T00:04:58.793535Z
Summary
A flaw was found in the SFTP server message decoding logic of libssh
Details

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

Database specific 
{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5449",
            "imported": "2025-10-18T14:10:41.626Z",
            "id": "CVE-2025-5449",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-5449",
            "published": "2025-07-25T18:15:26.967Z",
            "modified": "2025-08-14T00:39:43.210Z"
        }
    ],
    "license": "CC-BY-4.0"
}
References

Affected packages

Julia / libssh_jll

Package

Name
libssh_jll
Purl
pkg:julia/libssh_jll?uuid=a8d4f100-aa25-5708-be18-96e0805c2c9d

Affected ranges

Type
SEMVER
Events
Introduced
0.11.0+0
Fixed
0.11.3+0