Vulnerability · Published Feb 18, 2025 · Assigned by redhat
CVE-2025-26465Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
Medium 6.8
In plain English
A medium-severity security flaw in OpenSSH. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.7% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)7.7%top 5.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | openssh | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:9 | openssh | 8.7p1-45.el9 | ALSA-2025:6993 |
| AlmaLinux:8 | openssh-askpass | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:9 | openssh-askpass | 8.7p1-45.el9 | ALSA-2025:6993 |
| AlmaLinux:8 | openssh-cavs | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:8 | openssh-clients | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:9 | openssh-clients | 8.7p1-45.el9 | ALSA-2025:6993 |
| AlmaLinux:8 | openssh-keycat | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:9 | openssh-keycat | 8.7p1-45.el9 | ALSA-2025:6993 |
| AlmaLinux:8 | openssh-ldap | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:8 | openssh-server | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:9 | openssh-server | 8.7p1-45.el9 | ALSA-2025:6993 |
| AlmaLinux:8 | pam_ssh_agent_auth | 0.10.3-7.26.el8_10 | ALSA-2025:16823 |
| AlmaLinux:9 | pam_ssh_agent_auth | 0.10.4-5.45.el9 | ALSA-2025:6993 |
| Alpine:v3.20 | openssh | 9.7_p1-r5 | ALPINE-CVE-2025-26465 |
| Alpine:v3.21 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26465 |
| Alpine:v3.22 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26465 |
| Alpine:v3.23 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26465 |
| Alpine:v3.24 | openssh | 9.9_p2-r0 | ALPINE-CVE-2025-26465 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u5 | DSA-5868-1 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u5 | DEBIAN-CVE-2025-26465 |
| Debian:13 | openssh | 1:9.9p2-1 | DEBIAN-CVE-2025-26465 |
| Debian:14 | openssh | 1:9.9p2-1 | DEBIAN-CVE-2025-26465 |
| Rocky Linux:8 | openssh | 0:8.0p1-26.el8_10 | RLSA-2025:16823 |
| Rocky Linux:9 | openssh | 0:8.7p1-45.el9 | RLSA-2025:6993 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.11 | UBUNTU-CVE-2025-26465 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.11 | USN-7270-1 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.8 | USN-7270-1 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.8 | UBUNTU-CVE-2025-26465 |
| Ubuntu:22.04:LTS | openssh-ssh1 | no fix listed | UBUNTU-CVE-2025-26465 |
| Ubuntu:24.04:LTS | openssh-ssh1 | no fix listed | UBUNTU-CVE-2025-26465 |
| Ubuntu:25.10 | openssh-ssh1 | no fix listed | UBUNTU-CVE-2025-26465 |
| Ubuntu:26.04:LTS | openssh-ssh1 | no fix listed | UBUNTU-CVE-2025-26465 |
| Ubuntu:26.10 | openssh-ssh1 | no fix listed | UBUNTU-CVE-2025-26465 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenSSH | 6.8p1 – through 9.9p1 | |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | see references |
| Red Hat | Red Hat Discovery 1.14 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-390 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- RHSA-2025:16823 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3837 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:6993 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:8385 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-26465 vdb-entry, x_refsource_REDHAT
- https://access.redhat.com/solutions/7109879
- RHBZ#2344780 issue-tracking, x_refsource_REDHAT
- https://seclists.org/oss-sec/2025/q1/144
- https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html
- https://www.openwall.com/lists/oss-security/2025/02/18/1
- https://www.openwall.com/lists/oss-security/2025/02/18/4
- https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
- https://bugzilla.suse.com/show_bug.cgi?id=1237040
- https://security-tracker.debian.org/tracker/CVE-2025-26465
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
- https://ubuntu.com/security/CVE-2025-26465
- https://www.openssh.com/releasenotes.html#9.9p2
- https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html
- https://security.netapp.com/advisory/ntap-20250228-0003/
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh
- http://seclists.org/fulldisclosure/2025/May/8
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/Feb/18
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html