[UPDATE] [medium] libssh2: Vulnerability allows Denial of Service and disclosure of information

A remote, anonymous attacker can exploit a vulnerability in libssh2 to perform a Denial of Service attack or disclose information.

CSIRTS triage

What: libssh2 contains a vulnerability allowing remote denial of service and information disclosure.
Who is affected: All deployments of libssh2 are affected.
Urgency: Medium priority; not currently exploited but affects availability and confidentiality.
Action: Update libssh2 to a patched version when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch libssh2

Get an email when a new libssh2 advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2025-156611.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2025-15661	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.