Medium

libssh Session ID Out-of-Bounds Read

IdentifiersCVE-2021-3634CWE-125

CVE-2021-3634 is an out-of-bounds read vulnerability in libssh before version 0.9.6. libssh maintains both a session identifier and a key-exchange secret hash. Although these values are initially identical, the session identifier must remain unchanged across rekeying while the secret hash is recalculated. Historically, both buffers shared one length field. A key re-exchange that selects a key-exchange algorithm using a hash with a different output length causes this shared length to no longer accurately represent the retained session identifier. During a later key re-exchange, use of the incorrect length can read beyond the session identifier buffer.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A malicious SSH peer able to influence key-exchange negotiation and trigger rekeying can cause libssh to read memory beyond the session identifier buffer. This may disclose adjacent process memory and can destabilize the affected SSH client or server process. The available information establishes an out-of-bounds read; code execution is not established.

Mitigation

If you can’t patch tonight, do this now.

Until patched, restrict negotiated key-exchange algorithms so that rekeying cannot transition between algorithms with different hash output lengths. Where operationally feasible, avoid peer-controlled rekeying with untrusted SSH endpoints. This is a temporary compensating control; upgrading is the preferred remediation.

Remediation

Patch, then assume compromise.

Upgrade libssh to version 0.9.6 or later, or apply the vendor-supplied backport that separates the stored lengths of the session identifier and secret hash. Update applications and container images that bundle an affected libssh version, then rebuild dependent images or binaries.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DebianDebian Linuxoperating_system

Fedora ProjectFedoraapplication

LibsshLibsshapplication

NetAppCloud Backupapplication

OracleMysql Workbenchapplication

Red HatEnterprise Linuxoperating_system

Red HatVirtualizationapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHBA-2022:2229 - Bug Fix Advisory - Red Hat Customer Portal

A Linux kernel vulnerability referenced by the advisory; no technical details are provided in this content.

redhat accessNews

Jan 1, 2026

RHBA-2022:4630 - Bug Fix Advisory - Red Hat Customer Portal

CVE listed as addressed by this advisory; no technical description is provided in the content.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity