Description
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | OpenSSH | 6.8p1 – ≤ 9.9p1 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Discovery 1.14 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:9.9p2-1 | — |
| Debian 13 | openssh | 1:9.9p2-1 | — |
| Debian 12 | openssh | 1:9.2p1-2+deb12u5 | DSA-5868-1 |
| Debian 11 | openssh | 1:8.4p1-5+deb11u4 | DLA-4057-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openssh-ssh1 | No fix yet | — |
| Ubuntu 26.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu 25.10 | openssh-ssh1 | No fix yet | — |
| Ubuntu 24.04 LTS | openssh | 1:9.6p1-3ubuntu13.8 | USN-7270-1 |
| Ubuntu 24.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu 22.04 LTS | openssh | 1:8.9p1-3ubuntu0.11 | USN-7270-1 |
| Ubuntu 22.04 LTS | openssh-ssh1 | No fix yet | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | openssh | 1:8.2p1-4ubuntu0.12 | USN-7270-1 |
| Ubuntu 20.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu 18.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | openssh | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | openssh | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | openssh | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | openssh | 1:9.6p1-3ubuntu13.12+Fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssh | 1:8.9p1-3ubuntu0.11+Fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | openssh | 1:8.2p1-4ubuntu0.fips.0.12 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | openssh | 1:7.9p1-10~ubuntu18.04.fips.0.10 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssh | 1:7.2p2-4ubuntu2.fips.2.10.7 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssh | No fix yet | — |
| Ubuntu Pro 18.04 LTS | openssh | 1:7.6p1-4ubuntu0.7+esm4 | USN-7270-2 |
| Ubuntu Pro 16.04 LTS | openssh | 1:7.2p2-4ubuntu2.10+esm7 | USN-7270-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | openssh +4 | 8.7p1-45.el9 | RHSA-2025:6993 |
| RHEL 9 | pam_ssh_agent_auth | 0.10.4-5.45.el9 | RHSA-2025:6993 |
| RHEL 8 | openssh +6 | 8.0p1-26.el8_10 | RHSA-2025:16823 |
| RHEL 8 | pam_ssh_agent_auth | 0.10.3-7.26.el8_10 | RHSA-2025:16823 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | openssh +4 | 8.7p1-38.el9_4.5 | RHSA-2025:3837 |
| RHEL 9.4 EUS | pam_ssh_agent_auth | 0.10.4-5.38.el9_4.5 | RHSA-2025:3837 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | openssh +4 | 8.7p1-45.el9 | ALSA-2025:6993 |
| AlmaLinux 9 | pam_ssh_agent_auth | 0.10.4-5.45.el9 | ALSA-2025:6993 |
| AlmaLinux 8 | openssh +6 | 8.0p1-26.el8_10 | ALSA-2025:16823 |
| AlmaLinux 8 | pam_ssh_agent_auth | 0.10.3-7.26.el8_10 | ALSA-2025:16823 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | openssh | 8.7p1-45.el9 | RLSA-2025:6993 |
| Rocky Linux 8 | openssh | 8.0p1-26.el8_10 | RLSA-2025:16823 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | openssh | 9.6p1-150600.6.15.2 | SUSE-SU-2025:0585-1 |
| SLES 15 SP6 | openssh-askpass-gnome | 9.6p1-150600.6.15.1 | SUSE-SU-2025:0585-1 |
| SLES 15 SP5 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLES 15 SP4 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLES 15 SP3 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLES 12 SP5 | openssh +1 | 7.2p2-81.26.1 | SUSE-SU-2025:0659-1 |
| SLES 12 SP5 | openssh8.4 | 8.4p1-8.16.1 | SUSE-SU-2025:0744-1 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLES for SAP 15 SP4 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLES for SAP 15 SP3 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE Micro 6.1 | openssh | 9.6p1-slfo.1.1_2.1 | SUSE-SU-2025:20226-1 |
| SLE Micro 6.0 | openssh | 9.6p1-3.1 | SUSE-SU-2025:20160-1 |
| SLE Micro 5.5 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE Micro 5.4 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE Micro 5.3 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE Micro 5.2 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE Micro 5.1 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE HPC 15 SP5 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE HPC 15 SP4 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SLE HPC 15 SP3 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SUSE Manager Server 4.3 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SUSE Manager Proxy 4.3 | openssh | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
| SUSE Enterprise Storage 7.1 | openssh +1 | 8.4p1-150300.3.42.1 | SUSE-SU-2025:0605-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssh | 9.9p2-1.1 | openSUSE-SU-2025:14820-1 |
| openSUSE Leap 15.6 | openssh | 9.6p1-150600.6.15.2 | SUSE-SU-2025:0585-1 |
| openSUSE Leap 15.6 | openssh-askpass-gnome | 9.6p1-150600.6.15.1 | SUSE-SU-2025:0585-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssh | 9.9_p2-r0 | — |
| Alpine v3.23 | openssh | 9.9_p2-r0 | — |
| Alpine v3.22 | openssh | 9.9_p2-r0 | — |
| Alpine v3.21 | openssh | 9.9_p2-r0 | — |
| Alpine v3.20 | openssh | 9.7_p1-r5 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssh | 9.6_p1-r2 | — |
| Alpine v3.18 | openssh | 9.3_p2-r3 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openssh +3 | 8.7p1-8.amzn2023.0.14 | ALAS2023-2025-865 |
| Amazon Linux 2023 | pam_ssh_agent_auth | 0.10.4-4.8.amzn2023.0.14 | ALAS2023-2025-865 |
| Amazon Linux 2 | openssh +7 | 7.4p1-22.amzn2.0.9 | ALAS2-2025-2769 |
| Amazon Linux 2 | pam_ssh_agent_auth | 0.10.3-2.22.amzn2.0.9 | ALAS2-2025-2769 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openssh | 9.8p1-3 | — |
| Azure Linux 2 (CBL-Mariner) | openssh | 8.9p1-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | openssh +4 | 8.7p1-45.0.2.el9 | ELSA-2025-6993 |
| Oracle Linux 9 | pam_ssh_agent_auth | 0.10.4-5.45.0.2.el9 | ELSA-2025-6993 |
| Oracle Linux 8 | openssh +6 | 8.0p1-26.0.1.el8_10 | ELSA-2025-16823 |
| Oracle Linux 8 | pam_ssh_agent_auth | 0.10.3-7.26.0.1.el8_10 | ELSA-2025-16823 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
rxerium/CVE-2025-26465 ★ 10 · Feb 18, 2025
MitM attack allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to it
-
dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466 ★ 1 · Feb 21, 2025
Patch Manual para a correção das CVE-2025-26465-e-CVE-2025-26466, para sistemas sem update do OpenSSH
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 35
- ALSA-2025:6993 Moderate: openssh security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:16823 Moderate: openssh security update AlmaLinux Security Advisories · Oct 29, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- RHSA-2025:6993 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- WID-SEC-2025-0394 OpenSSH: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 15, 2026
- RHSA-2025:3837 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- RHSA-2025:16823 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- ICSA-26-202-04 Siemens SIDIS Secured SmartPlug CISA ICS & IT advisories · Jul 21, 2026
- NCSC-2026-0229 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jul 14, 2026
- SSA-585531 SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310 Siemens ProductCERT · Jul 14, 2026
- USN-7270-2 openssh vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- USN-7270-1 openssh vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:20160-1 Security update for openssh SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20226-1 Security update for openssh SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5868-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4057-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:0605-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0744-1 Security update for openssh8.4 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14820-1 openssh-9.9p2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0659-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0585-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1007 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 23, 2025
- RLSA-2025:16823 Moderate: openssh security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:6993 Moderate: openssh security update Rocky Linux Security Advisories · Oct 4, 2025
- SCA-2025-0011 Vulnerabilities affecting Endress+Hauser SSG-E210GC SICK PSIRT · Oct 2, 2025
- ELSA-2025-16823 Moderate: openssh security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 26, 2025
- SCA-2025-0009 Vulnerabilities affecting SICK TDC-E210GC SICK PSIRT · Aug 1, 2025
- VDE-2025-053 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jul 8, 2025
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025
- ELSA-2025-6993 Moderate: openssh security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- NCSC-2025-0151 Kwetsbaarheden verholpen in Apple macOS NCSC-NL (Netherlands) · May 13, 2025
- ALAS2-2025-2769 Moderate: openssh security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2025
- ALAS2023-2025-865 Moderate: openssh security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2025
References
- RHSA-2025:16823 vendor-advisory
- RHSA-2025:3837 vendor-advisory
- RHSA-2025:6993 vendor-advisory
- RHSA-2025:8385 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26465 vdb-entry
- https://access.redhat.com/solutions/7109879
- RHBZ#2344780 issue-tracking
- https://seclists.org/oss-sec/2025/q1/144