CVE-2025-26466

Name
CVE-2025-26466
Description
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2025-26466
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2345043
secalert@redhat.com https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt
af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20250228-0002/
af854a3a-2127-422b-91ae-364da2661108 https://bugzilla.suse.com/show_bug.cgi?id=1237041
af854a3a-2127-422b-91ae-364da2661108 https://security-tracker.debian.org/tracker/CVE-2025-26466
af854a3a-2127-422b-91ae-364da2661108 https://ubuntu.com/security/CVE-2025-26466
af854a3a-2127-422b-91ae-364da2661108 https://www.openwall.com/lists/oss-security/2025/02/18/1
af854a3a-2127-422b-91ae-364da2661108 https://www.openwall.com/lists/oss-security/2025/02/18/4
secalert@redhat.com https://seclists.org/oss-sec/2025/q1/144
af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2025/May/7
af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2025/May/8
af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2025/Feb/18
af854a3a-2127-422b-91ae-364da2661108 https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh
af854a3a-2127-422b-91ae-364da2661108 https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh

Match rules

CPE URI Source package Min version Max version
shopxo >= 9.5p1 <= 9.9p1
cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:* openssh == None == 9.5
cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:* openssh == None == 9.6
cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:* openssh == None == 9.7
cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:* openssh == None == 9.8
cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:* openssh == None == 9.9

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openssh edge-main 9.9_p2-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh 3.22-main 9.9_p2-r0 None fixed
openssh 3.21-main 9.9_p2-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh 3.20-main 9.7_p1-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh 3.19-main 9.7_p2-r5 None fixed
openssh 3.19-main 9.6_p1-r2 Natanael Copa <ncopa@alpinelinux.org> fixed