CVE-2025-26465

What it actually does

Mishandling of error codes during host key verification with VerifyHostKeyDNS enabled allows a machine-in-the-middle attacker to impersonate a legitimate server after first exhausting client memory resources.

Why it matters to the business

Attackers could intercept or manipulate SSH-based connections used by GitLab instances, potentially leading to unauthorized access or data exposure in environments relying on DNS-based host key verification; the high attack complexity and lack of known exploitation reduce immediate operational risk but still require patching across dependent packages.

How an attack unfolds

An attacker positions themselves to intercept SSH traffic, forces memory exhaustion on the client to trigger the error code mishandling, then impersonates the legitimate server during host key verification to complete the man-in-the-middle attack.

How to fix it

Upgrade affected GitLab installations to the fixed commit 67af793e55bd098111d3c3e265cd2c92eb283f1c or later; disable VerifyHostKeyDNS where feasible until patches are applied; monitor for updated OpenSSH packages in the underlying environment.

How to confirm the fix worked

Confirm the GitLab package version includes commit 67af793e55bd098111d3c3e265cd2c92eb283f1c; test SSH connections with VerifyHostKeyDNS enabled against known hosts to verify proper error handling and key verification.

Typical attack path

1. Position network access to perform traffic interception against a target using VerifyHostKeyDNS
2. Trigger memory exhaustion conditions on the OpenSSH client
3. Impersonate the legitimate SSH server during key verification
4. Exploit mishandled error codes to bypass verification and establish the MITM session

How to detect it

Review SSH client logs for unexpected host key verification failures or memory exhaustion events preceding connection attempts; examine network traffic for anomalies during key verification phases.

What your security team should do

• Apply the fixed GitLab commit 67af793e55bd098111d3c3e265cd2c92eb283f1c immediately in all environments using SSH host key verification
• Review and disable VerifyHostKeyDNS if not strictly required
• Audit SSH client configurations for DNS-based verification usage
• Monitor upstream OpenSSH updates for related fixes