Critical sslh Vulnerabilities Allow Remote Denial-of-Service Attacks
Security researchers have identified two critical vulnerabilities in sslh, a widely used protocol multiplexer that allows multiple services such as SSH, HTTPS, and OpenVPN to share a single network port.
Security researchers have identified two critical vulnerabilities in sslh, a widely used protocol multiplexer that allows multiple services such as SSH, HTTPS, and OpenVPN to share a single network port.
These vulnerabilities, identified as CVE-2025-46807 and CVE-2025-46806, could enable remote attackers to crash sslh or cause service unavailability, leading to a denial-of-service (DoS) for legitimate users.
CVE-2025-46807: File Descriptor Exhaustion Triggers Segmentation Fault
The vulnerability CVE-2025-46807 affects the sslh-select and sslh-ev variants. In these modes, sslh tracks incoming UDP sessions by allocating a new file descriptor for each. The software fails to close these descriptors if no further network activity occurs. An attacker can exploit this by creating numerous UDP sessions, each sending a single byte, until the limit of 1024 file descriptors is reached. Once this limit is exceeded, sslh encounters a NULL pointer dereference, leading to a segmentation fault and a complete crash of the service.
This vulnerability is classified as a resource exhaustion issue (CWE-770) and carries a high severity rating, with a CVSS 4.0 base score of 8.7. The sslh-fork variant is less susceptible, as it spawns a new process for each TCP connection and enforces a five-second timeout. However, spawning thousands of processes can still strain system resources, so administrators are advised to implement system-level protections such as Linux cgroups or ulimit constraints.
The vulnerability CVE-2025-46807 affects the sslh-select and sslh-ev variants.
CVE-2025-46806: Misaligned Memory Access in OpenVPN Probe
The second vulnerability, CVE-2025-46806, involves unsafe memory handling within the OpenVPN protocol probe. Sslh directly dereferences unaligned uint32_t pointers on heap-allocated network buffers. On architectures like ARM, this can cause a SIGBUS error, crashing the process. On x86_64 systems, the behavior is undefined, potentially leading to subtle failures. This flaw can be exploited remotely by sending a specially crafted UDP packet sequence, causing a denial-of-service condition.
The vulnerability is classified as a Use of Out-of-range Pointer Offset issue and affects all sslh versions prior to 2.2.4.
Both vulnerabilities have been addressed in sslh version 2.2.4. Users are strongly urged to upgrade to sslh v2.2.4 or later to mitigate these risks. Security experts recommend configuring system-level resource limits to further reduce the risk of DoS attacks, particularly in high-exposure environments.
While sslh remains a valuable tool for multiplexing network services, these vulnerabilities highlight the importance of rigorous code audits and timely patching. With the release of v2.2.4, sslh users can restore confidence in the tool’s resilience against remote denial-of-service threats.
Based on reporting by GBHackers.