CVE-2025-26466
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Severity
MEDIUM
CVSS score
5.9
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2025-02-28 22:15:40.080000
Last modified
2026-10-21 17:17:28.713000
View original CVE JSON
{
"id": "CVE-2025-26466",
"sourceIdentifier": "[email protected]",
"published": "2025-02-28T22:15:40.080",
"lastModified": "2026-10-21T17:17:28.713",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack."
},
{
"lang": "es",
"value": "Se ha descubierto un fallo en el paquete OpenSSH. Por cada paquete ping que recibe el servidor SSH, se asigna un paquete pong en un búfer de memoria y se almacena en una cola de paquetes. Solo se libera cuando finaliza el intercambio de claves entre el servidor y el cliente. Un cliente malintencionado puede seguir enviando dichos paquetes, lo que provoca un aumento descontrolado del consumo de memoria en el lado del servidor. En consecuencia, el servidor puede dejar de estar disponible, lo que da lugar a un ataque de denegación de servicio."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://www.openssh.com/",
"packageName": "OpenSSH",
"repo": "https://anongit.mindrot.org/openssh.git",
"versions": [
{
"version": "9.5p1",
"lessThanOrEqual": "9.9p1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openssh",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"versions": [
{
"version": "0:9.9p1-7.el10_0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openssh",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"versions": [
{
"version": "0:8.7p1-45.el9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openssh",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"versions": [
{
"version": "0:8.7p1-45.el9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openssh",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openssh",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openssh",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-8",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.0",
"lessThan": "V3.1.5",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-03-04T19:51:35.555196Z",
"id": "CVE-2025-26466",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
},
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "B95D97F9-56D8-4A03-8D97-C9C3BC103AEA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:*",
"matchCriteriaId": "2AFDD23D-3B76-4942-B222-843918EE7996"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "EA15AB35-EE6C-4435-9CD3-02E77A581CCD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:*",
"matchCriteriaId": "35061B84-4628-469C-BEC2-06207F066F30"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "E0DA97F7-489E-416E-9A01-DE7E4ABB8E47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*",
"matchCriteriaId": "BF2C0441-653D-4BD3-A45D-D97C929A596F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:*",
"matchCriteriaId": "63A10946-C4A4-4F77-828D-568579A2599C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*",
"matchCriteriaId": "E2B53BBB-6916-478C-A896-77C7F7E7D5DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*",
"matchCriteriaId": "F7A2B794-BA83-4A01-BD2E-541F18CB9E37"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "BF90B5A4-6E55-4369-B9D4-E7A061E797D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*",
"matchCriteriaId": "DE07EF30-B50E-4054-9918-50EFA416073B"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHBA-2025:6305",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:6993",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-26466",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345043",
"source": "[email protected]",
"tags": [
"Issue Tracking"
]
},
{
"url": "https://seclists.org/oss-sec/2025/q1/144",
"source": "[email protected]"
},
{
"url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "http://seclists.org/fulldisclosure/2025/Feb/18",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/7",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/8",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1237041",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2025-26466",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20250228-0002/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://ubuntu.com/security/CVE-2025-26466",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/02/18/1",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/02/18/4",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Third Party Advisory"
]
}
]
}