Vulnerability · Published Feb 28, 2025 · Assigned by redhat
CVE-2025-26466Openssh: denial-of-service in openssh
Medium 5.9
In plain English
A medium-severity resource allocation without limits in OpenSSH. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 38.7% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | openssh | 9.7_p1-r5 | ALPINE-CVE-2025-26466 |
| Alpine:v3.21 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26466 |
| Alpine:v3.22 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26466 |
| Alpine:v3.23 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26466 |
| Alpine:v3.24 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26466 |
| Debian:13 | openssh | 1:9.9p2-1 | DEBIAN-CVE-2025-26466 |
| Debian:14 | openssh | 1:9.9p2-1 | DEBIAN-CVE-2025-26466 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.11 | USN-7270-1 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.8 | USN-7270-1 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.8 | UBUNTU-CVE-2025-26466 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenSSH | 9.5p1 – through 9.9p1 | |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHBA-2025:6305 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:6993 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-26466 vdb-entry, x_refsource_REDHAT
- RHBZ#2345043 issue-tracking, x_refsource_REDHAT
- https://seclists.org/oss-sec/2025/q1/144
- https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt
- https://security.netapp.com/advisory/ntap-20250228-0002/
- https://www.openwall.com/lists/oss-security/2025/02/18/1
- https://www.openwall.com/lists/oss-security/2025/02/18/4
- https://bugzilla.suse.com/show_bug.cgi?id=1237041
- https://security-tracker.debian.org/tracker/CVE-2025-26466
- https://ubuntu.com/security/CVE-2025-26466
- http://seclists.org/fulldisclosure/2025/May/8
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/Feb/18
- https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh
- https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html