CVE-2025-26466
published 2025-02-28CVE-2025-26466: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of…
PriorityP346medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
39.85%
98.6th percentile
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_sequoia | — | — |
| apple | macos_sonoma | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openssh | < openssh 1:9.9p2-1 (forky) | openssh 1:9.9p2-1 (forky) |
| msrc | azl3_openssh_9.8p1-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_openssh_9.8p1-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_openssh_8.9p1-9_on_cbl_mariner_2.0 | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | >= 0 < 1:9.9p2-1 | 1:9.9p2-1 |
| openbsd | openssh | >= 0 < 1:9.9p2-1 | 1:9.9p2-1 |
| openbsd | openssh | >= 0 < 1:8.2p1-4ubuntu0.12 | 1:8.2p1-4ubuntu0.12 |
| openbsd | openssh | >= 0 < 1:8.9p1-3ubuntu0.11 | 1:8.9p1-3ubuntu0.11 |
| openbsd | openssh | >= 0 < 1:9.6p1-3ubuntu13.8 | 1:9.6p1-3ubuntu13.8 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect CVE-2025-26466 exploitation by monitoring for abnormal SSH pre-authentication traffic patterns: repeated small ping (16-byte) messages sent to the SSH server before key exchange completes, causing unbounded memory growth. ↗
- →Monitor for rapid growth in SSH server memory consumption and CPU overload during the pre-authentication (key exchange) phase as an indicator of CVE-2025-26466 exploitation. ↗
- →Enforce strict connection rate limits and monitor SSH traffic for abnormal patterns to detect potential CVE-2025-26466 DoS attacks early. ↗
- →Identify vulnerable OpenSSH instances (versions 9.5p1 through 9.9p1) in your environment as targets for CVE-2025-26466. ↗
- ·CVE-2025-26466 can be mitigated on the server side using existing OpenSSH configuration options: LoginGraceTime, MaxStartups, and PerSourcePenalties — these limit the window and rate of unauthenticated connections that can be abused. ↗
- ·The vulnerability is pre-authentication, meaning no valid credentials are required to trigger the DoS — any unauthenticated client can initiate the attack. ↗
- ·The flaw involves asymmetric resource consumption: a small 16-byte attacker-sent ping forces a 256-byte server-side buffered pong response, creating a 16:1 amplification ratio that is only freed after key exchange completes. ↗
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv6.8MEDIUM
vendor_ubuntu6.8MEDIUM
vendor_debian5.9LOW
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2025-26466: macOS Sequoia 15.5
vendor_apple·2025-05-12·CVSS 5.9
CVE-2025-26466 [MEDIUM] CVE-2025-26466: macOS Sequoia 15.5
Apple Security Update: About the security content of macOS Sequoia 15.5
Product: macOS Sequoia
Version: 15.5
CVE: CVE-2025-26466
Component: CVE-2025-26466
Apple
CVE-2025-26466: macOS Sonoma 14.7.6
vendor_apple·2025-05-12·CVSS 5.9
CVE-2025-26466 [MEDIUM] CVE-2025-26466: macOS Sonoma 14.7.6
Apple Security Update: About the security content of macOS Sonoma 14.7.6
Product: macOS Sonoma
Version: 14.7.6
CVE: CVE-2025-26466
Component: CVE-2025-26466
BSD
FreeBSD-SA-25:05.openssh: Multiple vulnerabilities in OpenSSH
bsd_advisories·2025-02-21·CVSS 6.8
CVE-2025-26465 [MEDIUM] FreeBSD-SA-25:05.openssh: Multiple vulnerabilities in OpenSSH
FreeBSD-SA-25:05.openssh Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in OpenSSH
Category: contrib
Module: openssh
Announced: 2025-02-21
Credits: Qualys Security Advisory team
Affects: All supported versions of FreeBSD.
Corrected: 2025-02-19 14:54:37 UTC (stable/14, 14.2-STABLE)
2025-02-21 02:56:26 UTC (releng/14.2, 14.2-RELEASE-p2)
2025-02-21 02:56:40 UTC (releng/14.1, 14.1-RELEASE-p8)
2025-02-19 16:05:16 UTC (stable/13, 13.5-STABLE)
2025-02-20 18:00:47 UTC (releng/13.5, 13.5-BETA3)
2025-02-21 02:56:50 UTC (releng/13.4, 13.4-RELEASE-p4)
CVE Name: CVE-2025-26465, CVE-2025-26466
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
Op
Red Hat
openssh: Denial-of-service in OpenSSH
vendor_redhat·2025-02-18·CVSS 5.9
CVE-2025-26466 [MEDIUM] CWE-770 openssh: Denial-of-service in OpenSSH
openssh: Denial-of-service in OpenSSH
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncont
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2025-02-18·CVSS 6.8
CVE-2025-26465 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that the OpenSSH client incorrectly handled the
non-default VerifyHostKeyDNS option. If that option were enabled, an
attacker could possibly impersonate a server by completely bypassing the
server identity check. (CVE-2025-26465)
It was discovered that OpenSSH incorrectly handled the transport-level ping
facility. A remote attacker could possibly use this issue to cause OpenSSH
clients and servers to consume resources, leading to a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2025-26466)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Openssh: denial-of-service in openssh
vendor_msrc·2025-02-11·CVSS 5.9
CVE-2025-26466 [MEDIUM] CWE-770 Openssh: denial-of-service in openssh
Openssh: denial-of-service in openssh
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/e
Debian
CVE-2025-26466: openssh - A flaw was found in the OpenSSH package. For each ping packet the SSH server rec...
vendor_debian·2025·CVSS 5.9
CVE-2025-26466 [MEDIUM] CVE-2025-26466: openssh - A flaw was found in the OpenSSH package. For each ping packet the SSH server rec...
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 1:9.9p2-1)
sid: resolved (fixed in 1:9.9p2-1)
trixie: resolved (fixed in 1:9.9p2-1)
Fortinet
Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466
vendor_fortinet·CVSS 5.9
CVE-2025-26466 [MEDIUM] Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466
FG-IR-25-122: Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466
CVSSv3 Score:
5.9
CVE-2025-26466A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Revised on 2026-03-04 00:00:00
GHSA
GHSA-m92w-x6j2-5gc5: A flaw was found in the OpenSSH package
ghsa_unreviewed·2025-03-01
CVE-2025-26466 [MEDIUM] CWE-400 GHSA-m92w-x6j2-5gc5: A flaw was found in the OpenSSH package
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
OSV
CVE-2025-26466: A flaw was found in the OpenSSH package
osv·2025-02-28·CVSS 5.9
CVE-2025-26466 [MEDIUM] CVE-2025-26466: A flaw was found in the OpenSSH package
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
OSV
openssh vulnerabilities
osv·2025-02-18·CVSS 6.8
CVE-2025-26465 [MEDIUM] openssh vulnerabilities
openssh vulnerabilities
It was discovered that the OpenSSH client incorrectly handled the
non-default VerifyHostKeyDNS option. If that option were enabled, an
attacker could possibly impersonate a server by completely bypassing the
server identity check. (CVE-2025-26465)
It was discovered that OpenSSH incorrectly handled the transport-level ping
facility. A remote attacker could possibly use this issue to cause OpenSSH
clients and servers to consume resources, leading to a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2025-26466)
No detection rules found.
No public exploits indexed.
Qualys
Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025
blogs_qualys·2025-08-12·CVSS 8.1
CVE-2024-6387 [HIGH] Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025
## Table of Contents
Why these two matter
Key Takeaways for Security Leaders: What Patching Really Looks Like
How Qualys Customers Achieve Same-Day Closes with TruRisk
We’re honored that the Pwnie Awards recognized the Qualys Threat Research Unit (TRU) with two wins at Black Hat/DEF CON this year—Best RCE for regreSSHion (CVE-2024-6387) and Epic Achievement for our multi-year work uncovering issues in OpenSSH, including CVE-2025-26465. Awards are nice; what matters is what the research means for defenders.
The Pwnie Awards, held annually at Black Hat and DEF CON, celebrate groundbreaking (and sometimes infamous) achievements in cybersecurity. Winning two in one year—especially for high-impact vulnerabilities in a staple like OpenSSH—is a massive validation for our TRU team. It undersc
Qualys
Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025 | Qualys
blogs_qualys·2025-08-12·CVSS 8.1
CVE-2024-6387 [HIGH] Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025 | Qualys
#### Table of Contents
- Why these two matter
- Key Takeaways for Security Leaders: What Patching Really Looks Like
- How Qualys Customers Achieve Same-Day Closes with TruRisk
We’re honored that the Pwnie Awards recognized the Qualys Threat Research Unit (TRU) with two wins at Black Hat/DEF CON this year—Best RCE for regreSSHion (CVE-2024-6387) and Epic Achievement for our multi-year work uncovering issues in OpenSSH, including CVE-2025-26465. Awards are nice; what matters is what the research means for defenders.
The Pwnie Awards, held annually at Black Hat and DEF CON, celebrate groundbreaking (and sometimes infamous) achievements in cybersecurity. Winning two in one year—especially for high-impact vulnerabilities in a staple like OpenSSH—is a massive validation for our TRU team. It u
Bleepingcomputer
Microsoft testing fix for Windows 11 bug breaking SSH connections
blogs_bleepingcomputer·2025-02-20
Microsoft testing fix for Windows 11 bug breaking SSH connections
## Microsoft testing fix for Windows 11 bug breaking SSH connections
## Sergiu Gatlan
Microsoft is now testing a fix for a longstanding known issue that is breaking SSH connections on some Windows 11 22H2 and 23H2 systems.
On Tuesday, Microsoft started rolling Windows 11 Build 26100.3321 (KB5052093) Insiders in the Release Preview Channel on Windows 11 24H2 (Build 26100) with a fix for this bug.
When it first acknowledged the issue in November, the company explained it affects a "limited number" of devices running Windows 11 enterprise, IOT, and education editions. However, Redmond is also investigating whether consumer customers using Windows 11 Home or Pro editions are affected.
"Following the installation of the October 2024 security update, some customers report that the OpenSSH (
Qualys
Qualys TRU Uncovers OpenSSH Vulnerabilities CVE‑2025‑26465 & CVE‑2025‑26466 | Qualys
blogs_qualys·2025-02-18·CVSS 6.8
CVE-2025-26465 [MEDIUM] Qualys TRU Uncovers OpenSSH Vulnerabilities CVE‑2025‑26465 & CVE‑2025‑26466 | Qualys
#### Table of Contents
- About OpenSSH: Securing Enterprise Communications and Infrastructure
- Affected OpenSSH versions:
- Potential Impact
- Technical Details
- Qualys QID Coverage
- Discover Vulnerable Assets Using Qualys CyberSecurity Asset Management (CSAM)
- Enhance Your Security Posture with Qualys Vulnerability Management, Detection, and Response (VMDR)
- Automatically Patch these vulnerabilities With Qualys Patch Management
- Detect and remediate CVE-2025-26466 and CVE-2025-26465 with Qualys TotalCloud Container Security
- Conclusion
The Qualys Threat Research Unit (TRU) has identified two vulnerabilities in OpenSSH. The first, tracked as CVE-2025-26465, allows an active machine-in-the-middle attack on the OpenSSH client when the VerifyHostKeyDNS option is enabled. The second,
Qualys
Qualys TRU Discovers Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466
blogs_qualys·2025-02-18·CVSS 6.8
CVE-2025-26466 [MEDIUM] Qualys TRU Discovers Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466
## Table of Contents
About OpenSSH: Securing Enterprise Communications and Infrastructure
Affected OpenSSH versions:
Potential Impact
Technical Details
Qualys QID Coverage
Discover Vulnerable Assets Using Qualys CyberSecurity Asset Management (CSAM)
Enhance Your Security Posture with Qualys Vulnerability Management, Detection, and Response (VMDR)
Automatically Patch these vulnerabilities With Qualys Patch Management
Detect and remediate CVE-2025-26466 and CVE-2025-26465 with Qualys TotalCloud Container Security
Conclusion
The Qualys Threat Research Unit (TRU) has identified two vulnerabilities in OpenSSH. The first, tracked as CVE-2025-26465, allows an active machine-in-the-middle attack on the OpenSSH client when the VerifyHostKeyDNS option is enabled. The second, CVE-2025-2646
Bleepingcomputer
New OpenSSH flaws expose SSH servers to MiTM and DoS attacks
blogs_bleepingcomputer·2025-02-18·CVSS 6.8
[MEDIUM] New OpenSSH flaws expose SSH servers to MiTM and DoS attacks
## New OpenSSH flaws expose SSH servers to MiTM and DoS attacks
## Bill Toulas
OpenSSH has released security updates addressing two vulnerabilities, a man-in-the-middle (MitM) and a denial of service flaw, with one of the flaws introduced over a decade ago.
Qualys discovered both vulnerabilities and demonstrated their exploitability to OpenSSH's maintainers.
OpenSSH (Open Secure Shell) is a free, open-source implementation of the SSH (Secure Shell) protocol, which provides encrypted communication for secure remote access, file transfers, and tunneling over untrusted networks.
It is one of the most widely used tools in the world, with high levels of adoption across Linux and Unix-based (BSD, macOS) systems found in enterprise environments, IT, DevOps, cloud computing, and cybersecurity
Bugzilla
CVE-2025-26466 openssh: Denial-of-service in OpenSSH
bugzilla·2025-02-11·CVSS 5.9
CVE-2025-26466 [MEDIUM] CVE-2025-26466 openssh: Denial-of-service in OpenSSH
CVE-2025-26466 openssh: Denial-of-service in OpenSSH
The OpenSSH client and server are vulnerable to a pre-authentication denial-of-service attack: an asymmetric resource consumption of both memory and CPU.
Discussion:
Making it Public as https://seclists.org/oss-sec/2025/q1/144
https://access.redhat.com/security/cve/CVE-2025-26466https://bugzilla.redhat.com/show_bug.cgi?id=2345043https://seclists.org/oss-sec/2025/q1/144https://www.qualys.com/2025/02/18/openssh-mitm-dos.txthttp://seclists.org/fulldisclosure/2025/Feb/18http://seclists.org/fulldisclosure/2025/May/7http://seclists.org/fulldisclosure/2025/May/8https://bugzilla.suse.com/show_bug.cgi?id=1237041https://security-tracker.debian.org/tracker/CVE-2025-26466https://security.netapp.com/advisory/ntap-20250228-0002/https://ubuntu.com/security/CVE-2025-26466https://www.openwall.com/lists/oss-security/2025/02/18/1https://www.openwall.com/lists/oss-security/2025/02/18/4https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-opensshhttps://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-opensshhttps://www.qualys.com/2025/02/18/openssh-mitm-dos.txt
2025-02-28
Published