A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Fix
Public exploits 2
- dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466 PoC on GitHub
- rxerium/CVE-2025-26465 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 2
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig Patch
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh Mitigation, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.8 · openbsd, netapp, redhatNVD modified 2026-10-21 17:17
Affected (CPE criteria) 10
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
References 28
- https://access.redhat.com/errata/RHSA-2025:16823
- https://access.redhat.com/errata/RHSA-2025:3837
- https://access.redhat.com/errata/RHSA-2025:6993
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2025-26465 Third Party Advisory
- https://access.redhat.com/solutions/7109879
- https://bugzilla.redhat.com/show_bug.cgi?id=2344780 Issue Tracking, Third Party Advisory
- https://seclists.org/oss-sec/2025/q1/144 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Feb/18
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/May/8
- https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1237040 Issue Tracking
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig Patch
- https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html Third Party Advisory
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-26465 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20250228-0003/ Third Party Advisory
- https://ubuntu.com/security/CVE-2025-26465 Third Party Advisory
- https://www.openssh.com/releasenotes.html#9.9p2 Release Notes
- https://www.openwall.com/lists/oss-security/2025/02/18/1 Mailing List, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2025/02/18/4 Mailing List, Third Party Advisory
- https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ Press/Media Coverage
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh Mitigation, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html
- https://seclists.org/oss-sec/2025/q1/144 Mailing List, Third Party Advisory