CVE-2025-46807: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-46807 is a vulnerability in sslh that allows attackers to easily exhaust file descriptors and deny legitimate users service. The vulnerability affects sslh versions before 2.2.4, specifically impacting the sslh-select and sslh-ev variants of the software. This issue was discovered by the SUSE security team and was publicly disclosed in May 2025 (SUSE Bug, NVD).

The vulnerability is classified as an Allocation of Resources Without Limits or Throttling (CWE-770) issue. The sslh-select implementation only checks UDP timeouts when there is network activity, otherwise the file descriptors stay open. When the file descriptor limit is encountered, the current implementation crashes with a SEGFAULT due to a NULL pointer dereference in sslh-select.c:161. The vulnerability has received a CVSS 4.0 Base Score of 8.7 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (SUSE Bug).

The vulnerability affects both sslh-select and sslh-ev variants, allowing attackers to create enough connections to fill up the 1024 file descriptors supported by sslh, making it impossible for genuine clients to connect. The issue is particularly impactful with UDP connections that need to be kept track of at the application level. When the file descriptor limit is reached, the application crashes with a SEGFAULT, resulting in a complete denial of service (SUSE Bug).

The vulnerability has been fixed in sslh version 2.2.4. The fix was implemented through a commit that addresses the file descriptor exhaustion issue. Users are advised to upgrade to the latest version to mitigate the vulnerability (GitHub Release).