A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Public exploits 5
- K0n9-log/cve-2025-26466-canvas PoC on GitHub
- acidboonrs/cve-2025-26466-openssh-poc PoC on GitHub
- mrowkoob/CVE-2025-26466-msf PoC on GitHub
- rxerium/CVE-2025-26466 PoC on GitHub
- tpirate/CVE-2025-26466 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Change history 2
- References+1 references (now 19)NVD modified 2026-10-15 02:17
- First seenCVSS 5.9 · openbsd, canonical, debianNVD modified 2026-10-08 22:17
Affected (CPE criteria) 14
cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*
References 19
- https://access.redhat.com/errata/RHBA-2025:6305
- https://access.redhat.com/errata/RHSA-2025:6993
- https://access.redhat.com/security/cve/CVE-2025-26466 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2345043 Issue Tracking
- https://seclists.org/oss-sec/2025/q1/144
- https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Feb/18
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/May/8
- https://bugzilla.suse.com/show_bug.cgi?id=1237041 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-26466 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20250228-0002/ Third Party Advisory
- https://ubuntu.com/security/CVE-2025-26466 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2025/02/18/1 Mailing List, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2025/02/18/4 Mailing List, Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh
- https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt Third Party Advisory