Description

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

INFO

Published Date :

2025-02-18T18:27:16.843Z

Last Modified :

2026-01-29T18:20:15.981Z

Source :

redhat
AFFECTED PRODUCTS

The following products are affected by CVE-2025-26465 vulnerability.

Vendors Products
Debian
  • Debian Linux
Netapp
  • Active Iq Unified Manager
  • Ontap
Openbsd
  • Openssh
Redhat
  • Discovery
  • Enterprise Linux
  • Openshift
  • Openshift Container Platform
  • Rhel Eus
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-26465.

URL Resource
http://seclists.org/fulldisclosure/2025/Feb/18 cve-icon
http://seclists.org/fulldisclosure/2025/May/7 cve-icon
http://seclists.org/fulldisclosure/2025/May/8 cve-icon
https://access.redhat.com/errata/RHSA-2025:16823 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:3837 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:6993 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:8385 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-26465 cve-icon cve-icon
https://access.redhat.com/solutions/7109879 cve-icon cve-icon
https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2344780 cve-icon cve-icon
https://bugzilla.suse.com/show_bug.cgi?id=1237040 cve-icon
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig cve-icon
https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html cve-icon
https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-26465 cve-icon
https://seclists.org/oss-sec/2025/q1/144 cve-icon cve-icon cve-icon cve-icon
https://security-tracker.debian.org/tracker/CVE-2025-26465 cve-icon
https://security.netapp.com/advisory/ntap-20250228-0003/ cve-icon
https://ubuntu.com/security/CVE-2025-26465 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-26465 cve-icon
https://www.openssh.com/releasenotes.html#9.9p2 cve-icon
https://www.openwall.com/lists/oss-security/2025/02/18/1 cve-icon
https://www.openwall.com/lists/oss-security/2025/02/18/4 cve-icon
https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ cve-icon
https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh cve-icon
https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact