This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] OpenSSH fixes 2 vulnerabilities

OpenSSH version 9.9p2 fixes two vulnerabilities [1]. The vulnerability CVE-2025-26465 was introduced into the product in version 6.8p1, CVE-2025-26466 in version 9.5p1. Among operating systems, fixes have been provided, for example, by Debian for the first vulnerability [2] (the stable releases are not affected by the second one [3]); Ubuntu [4][5]; Slackware [6]. Red Hat Enterprise Linux 9 is affected by the first vulnerability and no fix has been released yet [7]; the systems are not affected by the second vulnerability [8]. Gentoo has provided the fixed version 9.9_p2 for various architectures as stable or testing [9]. For OpenBSD, fixes are available as errata [10][11]. Operating system releases and fixed OpenSSH versions: Debian: bullseye (security) - 1:8.4p1-5+deb11u4 [2] bookworm (security) - 1:9.2p1-2+deb12u5 [2] sid - 1:9.9p2-1 [2][3] Ubuntu: oracular - 1:9.7p1-7ubuntu4.2 [4][5] noble - 1:9.6p1-3ubuntu13.8 [4][5] jammy - 1:8.9p1-3ubuntu0.11 [4] focal - 1:8.2p1-4ubuntu0.12 [4] bionic - 1:7.6p1-4ubuntu0.7+esm4 [4] xenial - 1:7.2p2-4ubuntu2.10+esm7 [4] Slackware: openssh-9.9p2-i586-1_slack15.0 [6] openssh-9.9p2-x86_64-1_slack15.0 [6] openssh-9.9p2-i686-1 [6] openssh-9.9p2-x86_64-1 [6] A detailed analysis of the vulnerabilities is available at [12].

OpenSSH - machine-in-the-middle (CVE-2025-26465)
CVSS 6.8 (Medium)

Due to incorrect handling of a return code during host key verification on the client side, an unauthenticated remote attacker can carry out a machine-in-the-middle attack and impersonate a legitimate server. For the attack to succeed, the attacker must first exhaust the client's memory resources [7]. The vulnerability affects only systems with the VerifyHostKeyDNS option enabled (set to "yes" or "ask"), which is disabled in the default configuration of most systems [7][12][13]. A PoC exploit has been released for the vulnerability [12], in which its exploitation is preceded by memory exhaustion by exploiting CVE-2025-26466.

The vulnerability is present in product:

  • *:OpenSSH;>=6.8,<=9.9

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 18. 2. 2025.

OpenSSH - DoS (CVE-2025-26466)
CVSS 5.9 (Medium)

An unauthenticated remote attacker can carry out a DoS attack on a server or client by sending a large number of PING packets [8]. Each received PING packet triggers an asymmetric memory allocation for the corresponding PONG packet, which is stored in a buffer without sufficient limitation, with quadratic time complexity of subsequent processing. On the server side, the risk can be mitigated using the built-in mechanisms LoginGraceTime, MaxStartups and, since version 9.8p1, also PerSourcePenalties. On the client side, however, no similar mitigation mechanisms exist [8][12].

The vulnerability is present in product:

  • *:OpenSSH;>=9.5,<=9.9

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 18. 2. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 19. 2. 2025.

CESNET, z.s.p.o. Logo