CVEvulnerability
CVE-2025-26465
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2025-02-18
- Last modified
- 2026-10-21
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-390
Description
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Affected configurations
• openbsd openssh (>= 6.9 <= 9.8)
• openbsd openssh 6.8
• openbsd openssh 9.9
• netapp active iq unified manager
• netapp ontap 9
• redhat openshift container platform 4.0
• debian debian linux 11.0
• debian debian linux 12.0
• redhat enterprise linux 9.0
Related
Weakness · CWE (1)
- CWE-390 Detection of Error Condition Without Action weakness
References
- https://access.redhat.com/errata/RHSA-2025:16823 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:3837 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:6993 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:8385 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2025-26465 Third Party Advisory
- https://access.redhat.com/solutions/7109879 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2344780 Issue Tracking, Third Party Advisory
- https://seclists.org/oss-sec/2025/q1/144 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Feb/18 seclists.org
- http://seclists.org/fulldisclosure/2025/May/7 seclists.org
- http://seclists.org/fulldisclosure/2025/May/8 seclists.org
- https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1237040 Issue Tracking
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig Patch
- https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html Third Party Advisory
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-26465 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20250228-0003/ Third Party Advisory
- https://ubuntu.com/security/CVE-2025-26465 Third Party Advisory
- https://www.openssh.com/releasenotes.html#9.9p2 Release Notes
- https://www.openwall.com/lists/oss-security/2025/02/18/1 Mailing List, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2025/02/18/4 Mailing List, Third Party Advisory
- https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ Press/Media Coverage
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh Mitigation, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html cert-portal.siemens.com
- https://seclists.org/oss-sec/2025/q1/144 Mailing List, Third Party Advisory