CVE-2025-26465
MEDIUM 2 PoCs
MEDIUM
Priority: 0.53
BB Relevance:
65/100
Published: 2025-02-18
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
None
Description
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Weakness Classification (1)
Affected Software (11)
| Vendor | Product | Version |
|---|---|---|
| — | — | 6.8p1 |
| debian | debian_linux | 11.0 |
| debian | debian_linux | 12.0 |
| netapp | active_iq_unified_manager | - |
| netapp | ontap | 9 |
| openbsd | openssh | 6.9 – 9.8 |
| openbsd | openssh | 6.8 |
| openbsd | openssh | 9.9 |
| openbsd | openssh | 9.9 |
| redhat | enterprise_linux | 9.0 |
| redhat | openshift_container_platform | 4.0 |
References & Advisories (27)
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Release Notes
Press/Media Coverage
Patch
Mitigation
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Issue Tracking
Showing 25 of 27 references