OpenSSH Flaws Expose Systems to Critical Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-26465 | A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. NVD description · AI analysis pending | 6.8 | 8% |
| — | ||
| CVE-2025-26466 | Unauthenticated Memory-Exhaustion DoS in OpenSSH CVE-2025-26466 is a denial-of-service flaw in the OpenSSH server: for every ping packet the SSH server receives, it allocates a corresponding pong packet in a memory buffer and adds it to a queue, and that memory is only freed once the server/client key exchange completes. A remote, unauthenticated attacker can hold a connection open and keep flooding it with ping packets faster than the key exchange finishes, driving uncontrolled memory growth until the SSH server becomes unavailable. The impact is availability-only, with no code execution or data exposure (CVSS 3.1 score 5.9, network vector with high attack complexity). Any system running an affected OpenSSH build is exposed, notably as packaged in Ubuntu Linux and Debian Linux, with internet-facing SSH endpoints the most attractive targets. No public PoC or confirmed in-the-wild exploitation is known and it is not in CISA KEV, but EPSS of ~40% (99th percentile) signals an elevated probability of exploitation within 30 days; the related headlines describing critical OpenSSH flaws also cover companion issues (including a man-in-the-middle bug) from the same disclosure. Do: Install the OpenSSH security updates released by Canonical and Debian in February 2025 (upstream fix in OpenSSH 9.9p2) and verify the running version with 'ssh -V' or your package manager. Until patched, reduce exposure by restricting SSH to trusted sources via firewall allowlists and rate-limiting unauthenticated connections (e.g., MaxStartups or fail2ban), and monitor sshd memory usage for abnormal growth. | 5.9 | 40% |
| mass~10-20 million internet-exposed SSH endpoints, with potentially millions of unpatched Ubuntu/Debian servers among them |
Full article374 words · extracted from infosecurity-magazine.com · click to collapse
Two significant security vulnerabilities in networking utility OpenSSH have been uncovered by security researchers.
These flaws, identified as CVE-2025-26465 and CVE-2025-26466, pose risks of man-in-the-middle (MitM) and denial-of-service (DoS) attacks.
The vulnerabilities, reported by the Qualys Security Advisory team, have prompted the release of OpenSSH 9.9p2, which addresses these issues.
Details of the Vulnerabilities
CVE-2025-26465: Man-in-the-Middle Attack
The first vulnerability (CVE-2025-26465) relates to the VerifyHostKeyDNS feature in the OpenSSH client. When enabled, this option could allow attackers to impersonate a server by bypassing identity verification checks. This flaw results from a logic error in how server identity is verified when memory allocation errors occur.
Although VerifyHostKeyDNS is disabled by default, administrators are urged to review their configurations. Notably, this feature has been enabled by default in some environments, such as FreeBSD, in the past.
This vulnerability has been around since late 2014. It underlines the critical need to reassess legacy settings regularly to ensure they comply with modern security standards.
CVE-2025-26466: Denial-of-Service Attack
The second vulnerability (CVE-2025-26466) involves a pre-authentication denial-of-service (DoS) attack that affects both OpenSSH’s client and server.
Attackers can exploit SSH2_MSG_PING packets to consume server resources disproportionately and cause resource exhaustion. This flaw stems from improper handling of memory and CPU resources during SSH key exchanges.
While server-side mitigations like LoginGraceTime and MaxStartups reduce the impact, the client-side remains vulnerable.
This issue has been present since August 2023. It highlights the complexities of ensuring efficient resource management in secure communication protocols.
Read more on OpenSSH vulnerabilities: Critical OpenSSH Flaw Enables Full System Compromise
Critical OpenSSH Update Now Available
To address these vulnerabilities, the OpenSSH team released version 9.9p2 today. This update includes fixes for the MitM and DoS flaws alongside several bug resolutions that enhance performance and security.
System administrators are strongly encouraged to act immediately and take the following steps:
- Upgrade immediately: Ensure OpenSSH installations are updated to version 9.9p2 as soon as possible
- Audit legacy configurations: Check for potentially risky settings, such as VerifyHostKeyDNS, that might still be enabled
- Strengthen resource controls: On servers, adjust settings like LoginGraceTime and MaxStartups to minimize the risk of DoS attacks
By acting promptly, organizations can reduce their exposure to these newly identified threats and enhance the overall security of their SSH infrastructure.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/openssh-flaws-expose-systems/