{"id":"CVE-2025-26466","state":"PUBLISHED","title":"Openssh: denial-of-service in openssh","description":"A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.","publishedAt":"2025-02-28T21:25:28.861Z","updatedAt":"2026-10-21T16:55:55.131Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["OpenSSH","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat OpenShift Container Platform 4"],"affected":[{"packageName":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"9.5p1","status":"affected","lessThanOrEqual":"9.9p1","versionType":"custom"}],"repo":"https://anongit.mindrot.org/openssh.git","collectionURL":"https://www.openssh.com/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"openssh","defaultStatus":"affected","versions":[{"version":"0:9.9p1-7.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"openssh","defaultStatus":"affected","versions":[{"version":"0:8.7p1-45.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"openssh","defaultStatus":"affected","versions":[{"version":"0:8.7p1-45.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"openssh","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"openssh","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"openssh","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":["https://access.redhat.com/errata/RHBA-2025:6305","https://access.redhat.com/errata/RHSA-2025:6993","https://access.redhat.com/security/cve/CVE-2025-26466","https://bugzilla.redhat.com/show_bug.cgi?id=2345043","https://seclists.org/oss-sec/2025/q1/144","https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt","https://security.netapp.com/advisory/ntap-20250228-0002/","https://www.openwall.com/lists/oss-security/2025/02/18/1","https://www.openwall.com/lists/oss-security/2025/02/18/4","https://bugzilla.suse.com/show_bug.cgi?id=1237041","https://security-tracker.debian.org/tracker/CVE-2025-26466","https://ubuntu.com/security/CVE-2025-26466","http://seclists.org/fulldisclosure/2025/May/8","http://seclists.org/fulldisclosure/2025/May/7","http://seclists.org/fulldisclosure/2025/Feb/18","https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh","https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/26xxx/CVE-2025-26466.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-26466","state":"PUBLISHED","datePublished":"2025-02-28T21:25:28.861Z","dateUpdated":"2026-10-21T16:55:55.131Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-02-10T18:31:47.979Z"},"containers":{"cna":{"title":"Openssh: denial-of-service in openssh","descriptions":[{"lang":"en","value":"A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack."}],"affected":[{"packageName":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"9.5p1","status":"affected","lessThanOrEqual":"9.9p1","versionType":"custom"}],"repo":"https://anongit.mindrot.org/openssh.git","collectionURL":"https://www.openssh.com/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"openssh","defaultStatus":"affected","versions":[{"version":"0:9.9p1-7.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"openssh","defaultStatus":"affected","versions":[{"version":"0:8.7p1-45.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"openssh","defaultStatus":"affected","versions":[{"version":"0:8.7p1-45.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"openssh","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"openssh","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"openssh","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2025:6305","name":"RHBA-2025:6305","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:6993","name":"RHSA-2025:6993","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-26466","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345043","name":"RHBZ#2345043","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://seclists.org/oss-sec/2025/q1/144"},{"url":"https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-21T16:55:55.131Z"},"datePublic":"2025-02-18T00:00:00.000Z","x_redhatCweChain":"CWE-770: Allocation of Resources Without Limits or Throttling","workarounds":[{"lang":"en","value":"This issue can be mitigated by setting the following three different options in the sshd configuration file located at: /etc/ssh/sshd_config\n\nMaxStartups: Set to a reasonable value, this option controls the maximum number of concurrent unauthenticated connections the SSH server accepts;\n\nPerSourcePenalties: Set its suboptions to a reasonable value, this option is used to help sshd to detect and drop connections that are potentially malicious for the SSH server;\n\nLoginGraceTime: Set to a resonable value, this option controls how much time the SSH server will wait the client to authenticate before dropping its connection;\n\nAll the three option above needs to be set to implement a full mitigation for this vulnerability."}],"timeline":[{"lang":"en","time":"2025-02-11T19:51:30.375Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-02-18T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://security.netapp.com/advisory/ntap-20250228-0002/"},{"url":"https://www.openwall.com/lists/oss-security/2025/02/18/1"},{"url":"https://www.openwall.com/lists/oss-security/2025/02/18/4"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1237041"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26466"},{"url":"https://ubuntu.com/security/CVE-2025-26466"},{"url":"http://seclists.org/fulldisclosure/2025/May/8"},{"url":"http://seclists.org/fulldisclosure/2025/May/7"},{"url":"http://seclists.org/fulldisclosure/2025/Feb/18"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-02-10T17:13:57.386Z"},"x_generator":{"engine":"ADPogram 0.0.1"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-04T19:51:35.555196Z","id":"CVE-2025-26466","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-04T19:51:39.308Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:05:55.555Z"},"x_adpType":"supplier"}]}}}