{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-26466", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-02-10T18:31:47.979Z", "datePublished": "2025-02-28T21:25:28.861Z", "dateUpdated": "2025-03-21T15:57:02.215Z"}, "containers": {"cna": {"title": "Openssh: denial-of-service in openssh", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack."}], "affected": [{"repo": "https://anongit.mindrot.org/openssh.git", "versions": [{"status": "affected", "version": "9.5p1", "versionType": "custom", "lessThanOrEqual": "9.9p1"}], "packageName": "OpenSSH", "collectionURL": "https://www.openssh.com/", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openssh", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openssh", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openssh", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openssh", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcos", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-26466", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345043", "name": "RHBZ#2345043", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt"}], "datePublic": "2025-02-18T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling", "workarounds": [{"lang": "en", "value": "This issue can be mitigated by setting the following three different options in the sshd configuration file located at: /etc/ssh/sshd_config\n\nMaxStartups: Set to a reasonable value, this option controls the maximum number of concurrent unauthenticated connections the SSH server accepts;\n\nPerSourcePenalties: Set its suboptions to a reasonable value, this option is used to help sshd to detect and drop connections that are potentially malicious for the SSH server;\n\nLoginGraceTime: Set to a resonable value, this option controls how much time the SSH server will wait the client to authenticate before dropping its connection;\n\nAll the three option above needs to be set to implement a full mitigation for this vulnerability."}], "timeline": [{"lang": "en", "time": "2025-02-11T19:51:30.375000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-02-18T00:00:00+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-03-21T15:57:02.215Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-03-05T03:48:43.236Z"}, "references": [{"url": "https://security.netapp.com/advisory/ntap-20250228-0002/"}, {"url": "https://www.openwall.com/lists/oss-security/2025/02/18/1"}, {"url": "https://www.openwall.com/lists/oss-security/2025/02/18/4"}, {"url": "https://bugzilla.suse.com/show_bug.cgi?id=1237041"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2025-26466"}, {"url": "https://ubuntu.com/security/CVE-2025-26466"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}, {"references": [{"url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-04T19:51:35.555196Z", "id": "CVE-2025-26466", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T19:51:39.308Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20250228-0002/"}, {"url": "https://www.openwall.com/lists/oss-security/2025/02/18/1"}, {"url": "https://www.openwall.com/lists/oss-security/2025/02/18/4"}, {"url": "https://bugzilla.suse.com/show_bug.cgi?id=1237041"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2025-26466"}, {"url": "https://ubuntu.com/security/CVE-2025-26466"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-03-05T03:48:43.236Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-26466", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-04T19:51:35.555196Z"}}}], "references": [{"url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T19:51:31.319Z"}}], "cna": {"title": "Openssh: denial-of-service in openssh", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://anongit.mindrot.org/openssh.git", "versions": [{"status": "affected", "version": "9.5p1", "versionType": "custom", "lessThanOrEqual": "9.9p1"}], "packageName": "OpenSSH", "collectionURL": "https://www.openssh.com/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "openssh", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "openssh", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "openssh", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "openssh", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "rhcos", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-11T19:51:30.375000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-02-18T00:00:00+00:00", "value": "Made public."}], "datePublic": "2025-02-18T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-26466", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345043", "name": "RHBZ#2345043", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt"}], "workarounds": [{"lang": "en", "value": "This issue can be mitigated by setting the following three different options in the sshd configuration file located at: /etc/ssh/sshd_config\n\nMaxStartups: Set to a reasonable value, this option controls the maximum number of concurrent unauthenticated connections the SSH server accepts;\n\nPerSourcePenalties: Set its suboptions to a reasonable value, this option is used to help sshd to detect and drop connections that are potentially malicious for the SSH server;\n\nLoginGraceTime: Set to a resonable value, this option controls how much time the SSH server will wait the client to authenticate before dropping its connection;\n\nAll the three option above needs to be set to implement a full mitigation for this vulnerability."}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-03-21T15:57:02.215Z"}, "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"}}, "cveMetadata": {"cveId": "CVE-2025-26466", "state": "PUBLISHED", "dateUpdated": "2025-03-21T15:57:02.215Z", "dateReserved": "2025-02-10T18:31:47.979Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-02-28T21:25:28.861Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*", "matchCriteriaId": "B95D97F9-56D8-4A03-8D97-C9C3BC103AEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:*", "matchCriteriaId": "2AFDD23D-3B76-4942-B222-843918EE7996", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:*", "matchCriteriaId": "EA15AB35-EE6C-4435-9CD3-02E77A581CCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:*", "matchCriteriaId": "35061B84-4628-469C-BEC2-06207F066F30", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:*", "matchCriteriaId": "E0DA97F7-489E-416E-9A01-DE7E4ABB8E47", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*", "matchCriteriaId": "BF2C0441-653D-4BD3-A45D-D97C929A596F", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:*", "matchCriteriaId": "63A10946-C4A4-4F77-828D-568579A2599C", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*", "matchCriteriaId": "E2B53BBB-6916-478C-A896-77C7F7E7D5DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*", "matchCriteriaId": "F7A2B794-BA83-4A01-BD2E-541F18CB9E37", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*", "matchCriteriaId": "BF90B5A4-6E55-4369-B9D4-E7A061E797D2", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*", "matchCriteriaId": "DE07EF30-B50E-4054-9918-50EFA416073B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*", "matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack."}, {"lang": "es", "value": "Se ha descubierto un fallo en el paquete OpenSSH. Por cada paquete ping que recibe el servidor SSH, se asigna un paquete pong en un b\u00fafer de memoria y se almacena en una cola de paquetes. Solo se libera cuando finaliza el intercambio de claves entre el servidor y el cliente. Un cliente malintencionado puede seguir enviando dichos paquetes, lo que provoca un aumento descontrolado del consumo de memoria en el lado del servidor. En consecuencia, el servidor puede dejar de estar disponible, lo que da lugar a un ataque de denegaci\u00f3n de servicio."}], "id": "CVE-2025-26466", "lastModified": "2025-03-21T16:15:18.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2025-02-28T22:15:40.080", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2025-26466"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345043"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1237041"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2025-26466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20250228-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://ubuntu.com/security/CVE-2025-26466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2025/02/18/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2025/02/18/4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory"], "url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "secalert@redhat.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"bugzilla": {"description": "openssh: Denial-of-service in OpenSSH", "id": "2345043", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345043"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.", "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack."], "mitigation": {"lang": "en:us", "value": "This issue can be mitigated by setting the following three different options in the sshd configuration file located at: /etc/ssh/sshd_config\nMaxStartups: Set to a reasonable value, this option controls the maximum number of concurrent unauthenticated connections the SSH server accepts;\nPerSourcePenalties: Set its suboptions to a reasonable value, this option is used to help sshd to detect and drop connections that are potentially malicious for the SSH server;\nLoginGraceTime: Set to a resonable value, this option controls how much time the SSH server will wait the client to authenticate before dropping its connection;\nAll the three option above needs to be set to implement a full mitigation for this vulnerability."}, "name": "CVE-2025-26466", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-02-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-26466\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-26466\nhttps://www.qualys.com/2025/02/18/openssh-mitm-dos.txt"], "statement": "The versions of OpenSSH as shipped with Red Hat Enterprise Linux 9 and older, and Red Hat Enterprise Linux CoreOS are not affected by this vulnerability as the OpenSSH versions distributed with those products are based on previous versions of OpenSSH's version that introduced the issue (openssh-9.5p1 upstream version).\nAlso this issue marked as a moderate severity vulnerability rather than important because, while it enables a pre-authentication denial-of-service (DoS) attack, it does not allow remote code execution, privilege escalation, or data exfiltration. \nThe attack is asymmetric in resource consumption, meaning an attacker can force excessive CPU and memory usage, but it still requires repeated connection attempts to sustain the impact. Moreover, OpenSSH provides built-in mitigation mechanisms, such as LoginGraceTime, MaxStartups, and PerSourcePenalties, which can significantly limit the attack\u2019s effectiveness if properly configured.", "threat_severity": "Moderate"}