CVE-2025-26465

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26465
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2025:3837
https://access.redhat.com/errata/RHSA-2025:6993
https://access.redhat.com/errata/RHSA-2025:8385
https://access.redhat.com/security/cve/CVE-2025-26465 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2344780 Issue Tracking Third Party Advisory
https://seclists.org/oss-sec/2025/q1/144 Mailing List Third Party Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1237040 Issue Tracking
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig Patch
https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html Third Party Advisory
https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2025-26465 Third Party Advisory
https://security.netapp.com/advisory/ntap-20250228-0003/ Third Party Advisory
https://ubuntu.com/security/CVE-2025-26465 Third Party Advisory
https://www.openssh.com/releasenotes.html#9.9p2 Release Notes
https://www.openwall.com/lists/oss-security/2025/02/18/1 Mailing List Third Party Advisory
https://www.openwall.com/lists/oss-security/2025/02/18/4 Mailing List Third Party Advisory
https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ Press/Media Coverage
https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh Mitigation Third Party Advisory
https://seclists.org/oss-sec/2025/q1/144 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

02 Jun 2025, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:6993 -
  • () https://access.redhat.com/errata/RHSA-2025:8385 -

14 Apr 2025, 11:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:3837 -
References () https://access.redhat.com/security/cve/CVE-2025-26465 - () https://access.redhat.com/security/cve/CVE-2025-26465 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2344780 - () https://bugzilla.redhat.com/show_bug.cgi?id=2344780 - Issue Tracking, Third Party Advisory
References () https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 - () https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 - Third Party Advisory
References () https://bugzilla.suse.com/show_bug.cgi?id=1237040 - () https://bugzilla.suse.com/show_bug.cgi?id=1237040 - Issue Tracking
References () https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig - () https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig - Patch
References () https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html - () https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html - Third Party Advisory
References () https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html - () https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html - Third Party Advisory
References () https://security-tracker.debian.org/tracker/CVE-2025-26465 - () https://security-tracker.debian.org/tracker/CVE-2025-26465 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20250228-0003/ - () https://security.netapp.com/advisory/ntap-20250228-0003/ - Third Party Advisory
References () https://ubuntu.com/security/CVE-2025-26465 - () https://ubuntu.com/security/CVE-2025-26465 - Third Party Advisory
References () https://www.openssh.com/releasenotes.html#9.9p2 - () https://www.openssh.com/releasenotes.html#9.9p2 - Release Notes
References () https://www.openwall.com/lists/oss-security/2025/02/18/1 - () https://www.openwall.com/lists/oss-security/2025/02/18/1 - Mailing List, Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2025/02/18/4 - () https://www.openwall.com/lists/oss-security/2025/02/18/4 - Mailing List, Third Party Advisory
References () https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ - () https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ - Press/Media Coverage
References () https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh - () https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh - Third Party Advisory
References () https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh - () https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh - Mitigation, Third Party Advisory
References () https://seclists.org/oss-sec/2025/q1/144 - () https://seclists.org/oss-sec/2025/q1/144 - Mailing List, Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
First Time Redhat enterprise Linux
Netapp active Iq Unified Manager
Debian debian Linux
Debian
Netapp ontap
Redhat
Openbsd
Redhat openshift Container Platform
Netapp
Openbsd openssh

03 Mar 2025, 18:15

Type Values Removed Values Added
References
  • () https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh -
  • () https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh -

28 Feb 2025, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250228-0003/ -

19 Feb 2025, 15:15

Type Values Removed Values Added
References
  • () https://seclists.org/oss-sec/2025/q1/144 -
Summary
  • (es) Se encontró una vulnerabilidad en OpenSSH cuando la opción VerifyHostKeyDNS está habilitada. Un ataque de máquina en el medio puede ser realizado mediante una máquina maliciosa que se hace pasar por un servidor legítimo. Este problema ocurre debido a cómo los códigos de error de OpenSSH Mishandles en condiciones específicas al verificar la clave del host. Para que un ataque se considere exitoso, el atacante debe lograr agotar el recurso de memoria del cliente primero, lo que gira la complejidad del ataque.

19 Feb 2025, 05:15

Type Values Removed Values Added
References
  • () https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 -
  • () https://bugzilla.suse.com/show_bug.cgi?id=1237040 -
  • () https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig -
  • () https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html -
  • () https://security-tracker.debian.org/tracker/CVE-2025-26465 -
  • () https://ubuntu.com/security/CVE-2025-26465 -
  • () https://www.openssh.com/releasenotes.html#9.9p2 -
  • () https://www.openwall.com/lists/oss-security/2025/02/18/1 -
  • () https://www.openwall.com/lists/oss-security/2025/02/18/4 -
  • () https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ -

18 Feb 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-18 19:15

Updated : 2025-06-02 15:15

NVD link : CVE-2025-26465

Mitre link : CVE-2025-26465

CVE.ORG link : CVE-2025-26465

JSON object : View

Products Affected

openbsd

  • openssh

redhat

  • enterprise_linux
  • openshift_container_platform

netapp

  • active_iq_unified_manager
  • ontap

debian

  • debian_linux
CWE
CWE-390

Detection of Error Condition Without Action