Medium severity5.9OSV Advisory· Published Feb 28, 2025· Updated Jun 30, 2026
CVE-2025-26466
CVE-2025-26466
Description
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
23ABOUT_TO_ADD_INET_ATON, AFTER_FREEBSD_PAM_MERGE, AFTER_KRB5_GSSAPI_MERGE, …+ 9 more
- (no CPE)range: ABOUT_TO_ADD_INET_ATON, AFTER_FREEBSD_PAM_MERGE, AFTER_KRB5_GSSAPI_MERGE, …
- cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*+ 1 more
- cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*
- osv-coords7 versionspkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/openssh&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2015.6pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6
< 9.6p1-150600.6.15.2+ 6 more
- (no CPE)range: < 9.6p1-150600.6.15.2
- (no CPE)range: < 9.9p2-1.1
- (no CPE)range: < 9.6p1-150600.6.15.1
- (no CPE)range: < 9.6p1-150600.6.15.2
- (no CPE)range: < 9.6p1-3.1
- (no CPE)range: < 9.6p1-slfo.1.1_2.1
- (no CPE)range: < 9.6p1-150600.6.15.1
Patches
Vulnerability mechanics
References
15- access.redhat.com/security/cve/CVE-2025-26466nvdThird Party Advisory
- bugzilla.suse.com/show_bug.cginvdThird Party Advisory
- security-tracker.debian.org/tracker/CVE-2025-26466nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20250228-0002/nvdThird Party Advisory
- ubuntu.com/security/CVE-2025-26466nvdThird Party Advisory
- www.openwall.com/lists/oss-security/2025/02/18/1nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2025/02/18/4nvdMailing ListThird Party Advisory
- www.qualys.com/2025/02/18/openssh-mitm-dos.txtnvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue Tracking
- seclists.org/fulldisclosure/2025/Feb/18nvd
- seclists.org/fulldisclosure/2025/May/7nvd
- seclists.org/fulldisclosure/2025/May/8nvd
- seclists.org/oss-sec/2025/q1/144nvd
- www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-opensshnvd
- www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-opensshnvd
News mentions
2- Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466Fortinet PSIRT · Mar 11, 2025
- Risky Business #780 -- ASD torched Zservers data while admins were drunkRisky Business · Feb 19, 2025