PT-2025-7168 · Openssh +11 · Openssh +11
Published
2025-02-17
·
Updated
2025-09-03
·
CVE-2025-26465
7.1
High
| Base vector | Vector | AV:N/AC:H/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
OpenSSH versions 6.8p1 through 9.9p1
Description:
A machine-in-the-middle attack vulnerability exists in OpenSSH when the `VerifyHostKeyDNS` option is enabled. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. The vulnerability allows a malicious machine to impersonate a legitimate server, potentially compromising the connection's integrity.
Recommendations:
For OpenSSH versions 6.8p1 through 9.9p1, update to version 9.9p2 or later to fix the vulnerability. As a temporary workaround, consider disabling the `VerifyHostKeyDNS` option until a patch is available. Restrict access to the SSH client to minimize the risk of exploitation. Avoid using the `VerifyHostKeyDNS` feature in the affected API endpoint until the issue is resolved.
Exploit
Fix
DoS
Weakness Enumeration
Related Identifiers
Affected Products
References · 257
- 🔥 https://github.com/rxerium/CVE-2025-26465⭐ 1 · Exploit
- 🔥 https://seclists.org/oss-sec/2025/q1/144 · Exploit
- https://errata.altlinux.org/ALT-PU-2025-3193 · Vendor Advisory
- https://osv.dev/vulnerability/openSUSE-SU-2025:14820-1 · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-26465 · Security Note
- https://security-tracker.debian.org/tracker/source-package/openssh · Vendor Advisory
- https://osv.dev/vulnerability/DSA-5868-1 · Vendor Advisory
- https://security-tracker.debian.org/tracker/DLA-4057-1 · Vendor Advisory
- https://ubuntu.com/security/notices/USN-7270-2 · Vendor Advisory
- https://osv.dev/vulnerability/SUSE-SU-2025:0659-1 · Vendor Advisory
- https://osv.dev/vulnerability/MGASA-2025-0080 · Vendor Advisory
- https://osv.dev/vulnerability/DLA-4057-1 · Vendor Advisory
- https://access.redhat.com/errata/RHSA-2025:3837 · Vendor Advisory
- https://errata.altlinux.org/ALT-PU-2025-3009 · Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-26465 · Vendor Advisory