ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

🗓️ 08 Oct 2025 08:02:05Reported by MicrosoftType

OpenSSH before 10.1 allows control characters in usernames, enabling exploits via ProxyCommand.

Reporter	Title	Published	Views	Family All 198
IBM Security Bulletins	Security Bulletin: IBM i is Affected by Improper Handling of Special Elements and Improper Neutralization of Null Byte Vulnerabilities in OpenSSH [CVE-2025-61984, CVE-2025-61985]	18 May 202620:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in openssh library (CVE-2025-61984, CVE-2025-61985) affect Power HMC.	31 Mar 202615:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSH affects IBM Netezza Appliance	15 Apr 202610:29	–	ibm
IBM Security Bulletins	Security Bulletin: AIX/VIOS is vulnerable to potential code execution (CVE-2025-61984, CVE-2025-61985) due to OpenSSH	6 Jan 202621:08	–	ibm
GithubExploit	Exploit for CVE-2025-61984	13 Oct 202501:42	–	githubexploit
GithubExploit	Exploit for CVE-2025-61984	7 Oct 202503:17	–	githubexploit
Tenable Nessus	Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2026-1441)	19 Feb 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : openssh, --advisory ALAS2-2026-3175 (ALAS-2026-3175)	19 Feb 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0198: openssh (ALINUX3-SA-2025:0198)	29 Dec 202500:00	–	nessus
Tenable Nessus	AlmaLinux 10 : openssh (ALSA-2025:23479)	23 Dec 202500:00	–	nessus