CVE-2025-26466

🗓️ 28 Feb 2025 21:25:28Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 14 Media mentions👁 1008 Views

Flaw in OpenSSH allows denial of service through uncontrolled memory consumption via ping packets.

Reporter	Title	Published	Views	Family All 91
0day.today	OpenSSH 9.9p1 Denial of Service / Man-In-The-Middle Vulnerability	18 Feb 202500:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM i is affected by a timing attack, handling signals in an unsafe manner, and uncontrolled memory consumption due to vulnerabilities in OpenSSH [CVE-2024-39894, CVE-2024-6387, CVE-2025-26466].	7 Aug 202515:48	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH	17 Mar 202522:11	–	ibm
GithubExploit	Exploit for Allocation of Resources Without Limits or Throttling in Openbsd Openssh	23 Jun 202513:00	–	githubexploit
GithubExploit	Exploit for Allocation of Resources Without Limits or Throttling in Openbsd Openssh	2 Apr 202613:32	–	githubexploit
FreeBSD	FreeBSD -- Multiple vulnerabilities in OpenSSH	21 Feb 202500:00	–	freebsd
AlpineLinux	CVE-2025-26466	28 Feb 202521:25	–	alpinelinux
Apple	About the security content of macOS Sonoma 14.7.6	12 May 202500:00	–	apple
AstraLinux	Astra Linux – Vulnerability in OpenSSH	11 Feb 202507:35	–	astralinux
Information Security Automation	February Linux Patch Wednesday	25 Feb 202510:19	–	avleonov

NVD

Node

openbsd opensshMatch9.5p1

openbsd opensshMatch9.6-

openbsd opensshMatch9.6p1

openbsd opensshMatch9.7-

openbsd opensshMatch9.7p1

openbsd opensshMatch9.8-

openbsd opensshMatch9.8p1

openbsd opensshMatch9.9-

openbsd opensshMatch9.9p1

Node

canonical ubuntu_linuxMatch24.04lts

canonical ubuntu_linuxMatch24.10

Node

debian debian_linuxMatch11.0

debian debian_linuxMatch12.0

debian debian_linuxMatch13.0

[
  {
    "repo": "https://anongit.mindrot.org/openssh.git",
    "versions": [
      {
        "status": "affected",
        "version": "9.5p1",
        "versionType": "custom",
        "lessThanOrEqual": "9.9p1"
      }
    ],
    "packageName": "OpenSSH",
    "collectionURL": "https://www.openssh.com/",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openssh",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openssh",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openssh",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openssh",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openssh",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhcos",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:openshift:4"
    ]
  }
]

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-26466
qualys	www.qualys.com/2025/02/18/openssh-mitm-dos.txt
seclists	www.seclists.org/oss-sec/2025/q1/144
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
seclists	www.seclists.org/fulldisclosure/2025/May/7
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-26466
security	www.security.netapp.com/advisory/ntap-20250228-0002/
ubuntu	www.ubuntu.com/security/CVE-2025-26466
vicarius	www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh
openwall	www.openwall.com/lists/oss-security/2025/02/18/4

17 Jun 2026 09:01Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.9

EPSS0.38474

SSVC

CWE-770