sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

🗓️ 04 Sep 2025 07:05:57Reported by MicrosoftType

OpenSSH before 7.3 uses Blowfish on static passwords when the username is missing, enabling remote user enumeration via timing.

Reporter	Title	Published	Views	Family All 218
IBM Security Bulletins	Security Bulletin: IBM Security Network Protection is affected by vulnerabilities in OpenSSH (CVE-2016-6210 CVE-2016-6515 CVE-2016-10009 CVE-2016-10011)	16 Jun 201822:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Flex System FC5022 16Gb SAN Scalable Switch (CVE-2016-6210)	31 Jan 201902:25	–	ibm
IBM Security Bulletins	IBM Security Network Protection / IBM QRadar Network Security / XGS Technote Index	31 Jan 202100:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in openssh affect IBM Flex System Manager (FSM)	18 Jun 201801:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSH affects Power Hardware Management Console	23 Sep 202101:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware.	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been fixed in products bundled with IBM Security Directory Suite 8.0.1	16 Jun 201822:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Access Manager Appliance is affected by OpenSSH vulnerabilities	16 Jun 201822:04	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from OpenSSL and OpenSSH affects IBM Netezza Host Management	18 Oct 201903:36	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSH affect PowerKVM	18 Jun 201801:38	–	ibm

Vulners

Node

microsoft azl3_openssh_9.8p1-4

18 Feb 2026 22:01Current

9.3High risk

Vulners AI Score9.3

CVSS 24.3

CVSS 35.9

CVSS 3.15.9

EPSS0.88944

SSVC