CVE-2025-26466
Medium · 5.9CVSS
5.9
EPSS
40.6%
Published
Feb 28, 2025
CISA due date
—
The record
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.19 | openssh | 0 | 9.6_p1-r2 |
| Alpine:v3.20 | openssh | 0 | 9.7_p1-r5 |
| Alpine:v3.21 | openssh | 0 | 9.9_p2-r0 |
| Alpine:v3.22 | openssh | 0 | 9.9_p2-r0 |
| Debian:13 | openssh | 0 | 1:9.9p2-1 |
| Debian:14 | openssh | 0 | 1:9.9p2-1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | openssh | 0 | 9.6p1-150600.6.15.2 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | openssh-askpass-gnome | 0 | 9.6p1-150600.6.15.1 |
| openSUSE:Leap 15.6 | openssh | 0 | 9.6p1-150600.6.15.2 |
| openSUSE:Leap 15.6 | openssh-askpass-gnome | 0 | 9.6p1-150600.6.15.1 |
| openSUSE:Tumbleweed | openssh | 0 | 9.9p2-1.1 |
Related vulnerabilities
- CVE-2024-6387 A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). Also affects openssh
- CVE-2023-48795 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… Also affects openssh
- CVE-2021-41617 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are… Also affects openssh
- CVE-2016-10009 Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4… Also affects openssh
- CVE-2024-39894 OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off… Also affects openssh
- CVE-2023-51385 In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host… Also affects openssh
- CVE-2023-51384 In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely… Also affects openssh
- CVE-2023-28531 ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended… Also affects openssh