Vulnerability in OpenSSH when the VerifyHostKeyDNS option is enabled (CVE-2025-26465)

🗓️ 27 Jan 2026 00:00:00Reported by Broadcom Security ResponseType

broadcom

broadcom🔗 support.broadcom.com👁 16 Views

OpenSSH VerifyHostKeyDNS enabled allows MITM via memory exhaustion during host verification.

Reporter	Title	Published	Views	Family All 227
0day.today	OpenSSH 9.9p1 Denial of Service / Man-In-The-Middle Vulnerability	18 Feb 202500:00	–	zdt
IBM Security Bulletins	Security Bulletin: Vulnerability in openssh (CVE-2025-26465) affects Power HMC.	3 Feb 202606:02	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in OpenSSH affects IBM Netezza Appliance	17 Dec 202513:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is vulnerable to a machine-in-the-middle attack due to mishandling error codes when verifying the host key by OpenSSH. [CVE-2025-26465]	14 May 202514:58	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH	17 Mar 202522:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a machine-in-the-middle attack in OpenSSH [CVE-2025-26465]	28 Aug 202515:21	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access	12 Jan 202623:03	–	ibm
GithubExploit	Exploit for Detection of Error Condition Without Action in Openbsd Openssh	18 Feb 202516:53	–	githubexploit
GithubExploit	Exploit for Allocation of Resources Without Limits or Throttling in Openbsd Openssh	23 Jun 202513:00	–	githubexploit
FreeBSD	FreeBSD -- Multiple vulnerabilities in OpenSSH	21 Feb 202500:00	–	freebsd

27 Jan 2026 19:19Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.8

EPSS0.06997

SSVC

OpenSSH host key verification memory exhaustion