CVE-2025-26466

Published Feb 28, 2025

Last updated 2 months ago

CVSS medium 5.9

SSH

Port (22)

Overview

Description: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Source: secalert@redhat.com
NVD status: Modified
Products: openssh, ubuntu_linux, debian_linux

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.9
Impact score: 3.6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

secalert@redhat.com: CWE-770
nvd@nist.gov: CWE-770

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*",
            "matchCriteriaId": "B95D97F9-56D8-4A03-8D97-C9C3BC103AEA",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:*",
            "matchCriteriaId": "2AFDD23D-3B76-4942-B222-843918EE7996",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:*",
            "matchCriteriaId": "EA15AB35-EE6C-4435-9CD3-02E77A581CCD",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:*",
            "matchCriteriaId": "35061B84-4628-469C-BEC2-06207F066F30",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:*",
            "matchCriteriaId": "E0DA97F7-489E-416E-9A01-DE7E4ABB8E47",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*",
            "matchCriteriaId": "BF2C0441-653D-4BD3-A45D-D97C929A596F",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:*",
            "matchCriteriaId": "63A10946-C4A4-4F77-828D-568579A2599C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*",
            "matchCriteriaId": "E2B53BBB-6916-478C-A896-77C7F7E7D5DE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*",
            "matchCriteriaId": "F7A2B794-BA83-4A01-BD2E-541F18CB9E37",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*",
            "matchCriteriaId": "BF90B5A4-6E55-4369-B9D4-E7A061E797D2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*",
            "matchCriteriaId": "DE07EF30-B50E-4054-9918-50EFA416073B",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References