CVE-2025-26465

EUVD-2025-4686

18.02.2025, 19:15

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 93%

Affected Products (NVD)

Vendor	Product	Version
openbsd	openssh	6.9 ≤ 𝑥 ≤ 9.8
openbsd	openssh	6.8:p1
openbsd	openssh	9.9
openbsd	openssh	9.9:p1
netapp	active_iq_unified_manager	-
redhat	openshift_container_platform	4.0
debian	debian_linux	11.0
debian	debian_linux	12.0
redhat	enterprise_linux	9.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	SIDIS Secured SmartPlug	𝑥 < V7.26.0310	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

openssh

bookworm	1:9.2p1-2+deb12u10 fixed
bookworm (security)	1:9.2p1-2+deb12u9 fixed
bullseye	vulnerable
bullseye (security)	1:8.4p1-5+deb11u7 fixed
forky	1:10.3p1-5 fixed
sid	1:10.4p1-1 fixed
trixie	1:10.0p1-7+deb13u4 fixed
trixie (security)	1:10.0p1-7+deb13u2 fixed

Ubuntu Releases

Ubuntu Product

Codename

openssh

bionic	Fixed 1:7.6p1-4ubuntu0.7+esm4 released
focal	Fixed 1:8.2p1-4ubuntu0.12 released
jammy	Fixed 1:8.9p1-3ubuntu0.11 released
noble	Fixed 1:9.6p1-3ubuntu13.8 released
oracular	Fixed 1:9.7p1-7ubuntu4.2 released
plucky	Fixed 9.9p1-3ubuntu3 released
questing	Fixed 9.9p1-3ubuntu3 released
resolute	Fixed 9.9p1-3ubuntu3 released
trusty	not-affected
xenial	Fixed 1:7.2p2-4ubuntu2.10+esm7 released

openssh-ssh1

bionic	ignored
focal	ignored
jammy	ignored
noble	ignored
oracular	ignored
plucky	ignored
questing	ignored
resolute	ignored

Red Hat Enterprise Linux Releases

Red Hat Product

Release

openssh

RHEL 8	0:8.0p1-26.el8_10 fixed
RHEL 9	0:8.7p1-45.el9 fixed

openssh-askpass

RHEL 8	0:8.0p1-26.el8_10 fixed
RHEL 9	0:8.7p1-45.el9 fixed

openssh-cavs

RHEL 8

0:8.0p1-26.el8_10

fixed

openssh-clients

RHEL 8	0:8.0p1-26.el8_10 fixed
RHEL 9	0:8.7p1-45.el9 fixed

openssh-keycat

RHEL 8	0:8.0p1-26.el8_10 fixed
RHEL 9	0:8.7p1-45.el9 fixed

openssh-ldap

RHEL 8

0:8.0p1-26.el8_10

fixed

openssh-server

RHEL 8	0:8.0p1-26.el8_10 fixed
RHEL 9	0:8.7p1-45.el9 fixed

pam

RHEL 8	0:0.10.3-7.26.el8_10 fixed
RHEL 9	0:0.10.4-5.45.el9 fixed

Amazon Linux Releases

Amazon Package

Release

openssh

Amazon Linux 2	0:7.4p1-22.amzn2.0.9 fixed
Amazon Linux 2023	0:8.7p1-8.amzn2023.0.14 fixed

openssh-askpass

Amazon Linux 2

0:7.4p1-22.amzn2.0.9

fixed

openssh-cavs

Amazon Linux 2

0:7.4p1-22.amzn2.0.9

fixed

openssh-clients

Amazon Linux 2	0:7.4p1-22.amzn2.0.9 fixed
Amazon Linux 2023	0:8.7p1-8.amzn2023.0.14 fixed

openssh-clients-debuginfo

Amazon Linux 2023

0:8.7p1-8.amzn2023.0.14

fixed

openssh-debuginfo

Amazon Linux 2	0:7.4p1-22.amzn2.0.9 fixed
Amazon Linux 2023	0:8.7p1-8.amzn2023.0.14 fixed

openssh-debugsource

Amazon Linux 2023

0:8.7p1-8.amzn2023.0.14

fixed

openssh-keycat

Amazon Linux 2	0:7.4p1-22.amzn2.0.9 fixed
Amazon Linux 2023	0:8.7p1-8.amzn2023.0.14 fixed

openssh-keycat-debuginfo

Amazon Linux 2023

0:8.7p1-8.amzn2023.0.14

fixed

openssh-ldap

Amazon Linux 2

0:7.4p1-22.amzn2.0.9

fixed

openssh-server

Amazon Linux 2	0:7.4p1-22.amzn2.0.9 fixed
Amazon Linux 2023	0:8.7p1-8.amzn2023.0.14 fixed

openssh-server-debuginfo

Amazon Linux 2023

0:8.7p1-8.amzn2023.0.14

fixed

openssh-server-sysvinit

Amazon Linux 2

0:7.4p1-22.amzn2.0.9

fixed

pam_ssh_agent_auth

Amazon Linux 2	0:0.10.3-2.22.amzn2.0.9 fixed
Amazon Linux 2023	0:0.10.4-4.8.amzn2023.0.14 fixed

pam_ssh_agent_auth-debuginfo

Amazon Linux 2023

0:0.10.4-4.8.amzn2023.0.14

fixed

Azure Linux Releases

Azure Package

Release

openssh

Azure Linux 3.0	0:9.8p1-3.azl3 fixed
CBL-Mariner 2.0	0:8.9p1-7.cm2 fixed

Common Weakness Enumeration

CWE-390 - Detection of Error Condition Without Action
The software detects a specific error, but takes no actions to handle the error.

References

https://access.redhat.com/errata/RHSA-2025:16823

https://access.redhat.com/errata/RHSA-2025:3837

https://access.redhat.com/errata/RHSA-2025:6993

https://access.redhat.com/errata/RHSA-2025:8385

https://access.redhat.com/security/cve/CVE-2025-26465

https://access.redhat.com/solutions/7109879

https://bugzilla.redhat.com/show_bug.cgi?id=2344780

https://seclists.org/oss-sec/2025/q1/144

http://seclists.org/fulldisclosure/2025/Feb/18

http://seclists.org/fulldisclosure/2025/May/7

http://seclists.org/fulldisclosure/2025/May/8

https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466

https://bugzilla.suse.com/show_bug.cgi?id=1237040

https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig

https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html

https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html

https://security-tracker.debian.org/tracker/CVE-2025-26465

https://security.netapp.com/advisory/ntap-20250228-0003/

https://ubuntu.com/security/CVE-2025-26465

https://www.openssh.com/releasenotes.html#9.9p2

https://www.openwall.com/lists/oss-security/2025/02/18/1

https://www.openwall.com/lists/oss-security/2025/02/18/4

https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/

https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh

https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

https://cert-portal.siemens.com/productcert/html/ssa-585531.html

https://seclists.org/oss-sec/2025/q1/144