Log in Start free

Vulnerability · Published Oct 6, 2025 · Assigned by mitre

CVE-2025-61984

Low 3.6

In plain English

A low-severity security flaw in OpenSSH from OpenBSD. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10openssh9.9p1-12.el10_1.alma.1ALSA-2025:23479
AlmaLinux:8openssh8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:9openssh8.7p1-47.el9_7.alma.1ALSA-2025:23480
AlmaLinux:10openssh-askpass9.9p1-12.el10_1.alma.1ALSA-2025:23479
AlmaLinux:8openssh-askpass8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:9openssh-askpass8.7p1-47.el9_7.alma.1ALSA-2025:23480
AlmaLinux:8openssh-cavs8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:10openssh-clients9.9p1-12.el10_1.alma.1ALSA-2025:23479
AlmaLinux:8openssh-clients8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:9openssh-clients8.7p1-47.el9_7.alma.1ALSA-2025:23480
AlmaLinux:10openssh-keycat9.9p1-12.el10_1.alma.1ALSA-2025:23479
AlmaLinux:8openssh-keycat8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:9openssh-keycat8.7p1-47.el9_7.alma.1ALSA-2025:23480
AlmaLinux:10openssh-keysign9.9p1-12.el10_1.alma.1ALSA-2025:23479
AlmaLinux:8openssh-ldap8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:10openssh-server9.9p1-12.el10_1.alma.1ALSA-2025:23479
AlmaLinux:8openssh-server8.0p1-27.el8_10ALSA-2025:23481
AlmaLinux:9openssh-server8.7p1-47.el9_7.alma.1ALSA-2025:23480
AlmaLinux:8pam_ssh_agent_auth0.10.3-7.27.el8_10ALSA-2025:23481
AlmaLinux:9pam_ssh_agent_auth0.10.4-5.47.el9_7.alma.1ALSA-2025:23480
Alpine:v3.22openssh10.0_p1-r10ALPINE-CVE-2025-61984
Alpine:v3.23openssh10.1_p1-r0ALPINE-CVE-2025-61984
Alpine:v3.24openssh10.1_p1-r0ALPINE-CVE-2025-61984
Debian:12openssh1:9.2p1-2+deb12u8DEBIAN-CVE-2025-61984
Debian:13openssh1:10.0p1-7+deb13u1DEBIAN-CVE-2025-61984
Debian:14openssh1:10.1p1-1DEBIAN-CVE-2025-61984
Rocky Linux:10openssh0:9.9p1-12.el10_1.rocky.0.1RLSA-2025:23479
Rocky Linux:8openssh0:8.0p1-27.el8_10RLSA-2025:23481
Rocky Linux:9openssh0:8.7p1-47.el9_7.rocky.0.1RLSA-2025:23480
Ubuntu:22.04:LTSopenssh1:8.9p1-3ubuntu0.14UBUNTU-CVE-2025-61984
Ubuntu:24.04:LTSopenssh1:9.6p1-3ubuntu13.15UBUNTU-CVE-2025-61984
Ubuntu:25.10openssh1:10.0p1-5ubuntu5.1UBUNTU-CVE-2025-61984
Ubuntu:26.04:LTSopenssh1:10.2p1-2ubuntu1UBUNTU-CVE-2025-61984
Ubuntu:22.04:LTSopenssh-ssh1no fix listedUBUNTU-CVE-2025-61984
Ubuntu:24.04:LTSopenssh-ssh1no fix listedUBUNTU-CVE-2025-61984
Ubuntu:25.10openssh-ssh1no fix listedUBUNTU-CVE-2025-61984
Ubuntu:26.04:LTSopenssh-ssh1no fix listedUBUNTU-CVE-2025-61984
Ubuntu:26.10openssh-ssh1no fix listedUBUNTU-CVE-2025-61984

Affected products (as reported)

VendorProductVersions
OpenBSD OpenSSH 0 – before 10.1

Weakness: CWE-159 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References