CVE-2023-25136

Description

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	openssh	1:9.2p1-1	—
Debian 13	openssh	1:9.2p1-1	—
Debian 12	openssh	1:9.2p1-1	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	openssh +4	8.7p1-29.el9_2	RHSA-2023:2645
RHEL 9	pam_ssh_agent_auth	0.10.4-5.29.el9_2	RHSA-2023:2645

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	openssh +4	8.7p1-29.el9_2	ALSA-2023:2645
AlmaLinux 9	pam_ssh_agent_auth	0.10.4-5.29.el9_2	ALSA-2023:2645

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	openssh +4	8.7p1-29.el9_2	ELSA-2023-2645
Oracle Linux 9	pam_ssh_agent_auth	0.10.4-5.29.el9_2	ELSA-2023-2645

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	openssh	9.2_p1-r0	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 11 repositories · most starred shown

Christbowel/CVE-2023-25136 ★ 109 · Feb 22, 2023

OpenSSH 9.1 vulnerability mass scan and exploit
adhikara13/CVE-2023-25136 ★ 47 · Apr 18, 2023

OpenSSH Pre-Auth Double Free CVE-2023-25136 POC
jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free ★ 41 · Feb 7, 2023
nhakobyan685/CVE-2023-25136 ★ 8 · Apr 28, 2023

OpenSSH 9.1 vulnerability mass scan and exploit
H4K6/CVE-2023-25136 ★ 5 · Jun 30, 2023

OpenSSH 9.1漏洞大规模扫描和利用
malvika-thakur/CVE-2023-25136 ★ 3 · Sep 21, 2023

OpenSSH Pre-Auth Double Free CVE-2023-25136 – Writeup and Proof-of-Concept
axylisdead/CVE-2023-25136_POC ★ 3 · Jun 3, 2023

CVE-2023-25136 POC written by axylisdead
ticofookfook/CVE-2023-25136 ★ 3 · Feb 14, 2023
mrmtwoj/CVE-2023-25136 ★ 1 · Jan 16, 2025

This vulnerability is of the "double-free" type, which occurs during the processing of key exchange (KEX) algorithms in OpenSSH. A "double-free" vulnerability happens when memory that has already bee…
Business1sg00d/CVE-2023-25136 ★ 1 · Sep 4, 2023

Looking into the memory when sshd 9.1p1 aborts due to a double free bug.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

ALSA-2023:2645 Moderate: openssh security update AlmaLinux Security Advisories · Oct 29, 2026
SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
RHSA-2023:2645 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
WID-SEC-2023-0279 OpenSSH: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2023
ELSA-2023-2645 Moderate: openssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 17, 2023

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The …