CVE-2025-61985 — Improper Neutralization of Null Byte or NUL Character in Openssh

CWE-158 — Improper Neutralization of Null Byte or NUL Character10 documents9 sources
Severity
3.6LOWNVD
EPSS
0.0%
top 96.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Openbsd OpensshPaloalto Prisma SD
Timeline
PublishedOct 6
Latest updateMar 12

Description

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 1.0 | Impact: 2.5

Affected Packages3 packages

▶CVEListV5openbsd/openssh< 10.1
▶Debianopenbsd/openssh< 1:9.2p1-2+deb12u8+2
▶Palo Altopaloalto/prisma_sd

🔴Vulnerability Details

3
CVEList
CVE-2025-61985: ssh in OpenSSH before 10↗2025-10-06
▶
OSV
CVE-2025-61985: ssh in OpenSSH before 10↗2025-10-06
▶
GHSA
GHSA-8gmf-r74v-362p: ssh in OpenSSH before 10↗2025-10-06
▶

📋Vendor Advisories

6
Ubuntu
OpenSSH vulnerabilities↗2026-03-12
▶
Ubuntu
OpenSSH vulnerabilities↗2026-03-12
▶
Palo Alto
PAN-SA-2025-0017 Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION↗2025-11-02
▶
Microsoft
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.↗2025-10-14
▶
Red Hat
openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand↗2025-10-06
▶
CVE-2025-61985 — Openbsd Openssh vulnerability | cvebase