CVE-2025-26465 json
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
published 2025-02-18 20 mo ago modified 2026-11-05 3 d ago also EUVD-2025-4686 , JLSEC-2026-72
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.7%
- EPSS 7.7% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Patch / fix
- julia OpenSSH_jll 9.9.1+0
- Red Hat Red Hat Enterprise Linux 8 0:8.0p1-26.el8_10
- Red Hat Red Hat Enterprise Linux 9 0:8.7p1-45.el9
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:8.7p1-38.el9_4.5
- Red Hat Red Hat Discovery 1.14 1.14.3-1748529279
- Siemens SIDIS Secured SmartPlug V7.26.0310
- openssh Debian 12 1:9.2p1-2+deb12u5
- openssh Debian 14, Debian 13 1:9.9p2-1
debian advisories DEBIAN-CVE-2025-26465
- openssh Ubuntu 20.04 LTS 1:8.2p1-4ubuntu0.12
- openssh Ubuntu 22.04 LTS 1:8.9p1-3ubuntu0.11
- openssh Ubuntu 24.04 LTS 1:9.6p1-3ubuntu13.8
- openssh Ubuntu Pro 16.04 LTS 1:7.2p2-4ubuntu2.10+esm7
- openssh Ubuntu Pro FIPS-updates 16.04 LTS 1:7.2p2-4ubuntu2.fips.2.10.7
- openssh Ubuntu Pro 18.04 LTS 1:7.6p1-4ubuntu0.7+esm4
- openssh Ubuntu Pro FIPS-updates 18.04 LTS 1:7.9p1-10~ubuntu18.04.fips.0.10
- openssh Ubuntu Pro FIPS-updates 20.04 LTS 1:8.2p1-4ubuntu0.fips.0.12
ubuntu advisories UBUNTU-CVE-2025-26465
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openssh RHEL 8 8.0p1-26.el8_10
- openssh-cavs RHEL 8 8.0p1-26.el8_10
- openssh-ldap RHEL 8 8.0p1-26.el8_10
- openssh-keycat RHEL 8 8.0p1-26.el8_10
- openssh-server RHEL 8 8.0p1-26.el8_10
- openssh-askpass RHEL 8 8.0p1-26.el8_10
- openssh-clients RHEL 8 8.0p1-26.el8_10
- pam_ssh_agent_auth RHEL 8 0.10.3-7.26.el8_10
red hat advisories RHSA-2025:16823RHSA-2025:6993RHSA-2025:3837
- openssh Linux Micro 6.0 9.6p1-3.1
- openssh Linux Micro 6.1 9.6p1-slfo.1.1_2.1
- openssh SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +16 more 8.4p1-150300.3.42.1
- openssh-askpass-gnome SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +9 more 8.4p1-150300.3.42.1
- openssh SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 9.6p1-150600.6.15.2
- openssh-askpass-gnome SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 9.6p1-150600.6.15.1
- openssh8.4 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 8.4p1-8.16.1
- openssh SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 7.2p2-81.26.1
suse advisories SUSE-SU-2025:20160-1SUSE-SU-2025:0744-1SUSE-SU-2025:20226-1SUSE-SU-2025:0659-1SUSE-SU-2025:0605-1SUSE-SU-2025:0585-1
- openssh openSUSE Tumbleweed 9.9p2-1.1
opensuse advisories openSUSE-SU-2025:14820-1
- openssh AlmaLinux 8 8.0p1-26.el8_10
- openssh-cavs AlmaLinux 8 8.0p1-26.el8_10
- openssh-ldap AlmaLinux 8 8.0p1-26.el8_10
- openssh-keycat AlmaLinux 8 8.0p1-26.el8_10
- openssh-server AlmaLinux 8 8.0p1-26.el8_10
- openssh-askpass AlmaLinux 8 8.0p1-26.el8_10
- openssh-clients AlmaLinux 8 8.0p1-26.el8_10
- pam_ssh_agent_auth AlmaLinux 8 0.10.3-7.26.el8_10
almalinux advisories ALSA-2025:16823ALSA-2025:6993
- openssh Rocky Linux 9 8.7p1-45.el9
- openssh Rocky Linux 8 8.0p1-26.el8_10
rocky linux advisories RLSA-2025:6993RLSA-2025:16823
- openssh Alpine 3.18 9.3_p2-r3
- openssh Alpine 3.19 9.6_p1-r2
- openssh Alpine 3.20 9.7_p1-r5
- openssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 9.9_p2-r0
alpine advisories ALPINE-CVE-2025-26465
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openssh CBL-Mariner 2.0 8.9p1-7
- openssh Azure Linux 3.0 9.8p1-3
azure linux advisories AZL-56891AZL-56894
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-26465 updated cvss 6.8
openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled
-
Red Hat Enterprise Linux 6 openssh, openssh-ldap, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_auth Red Hat Enterprise Linux 7 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +3 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9affected: workaround, no fix available “Fix deferred”
-
Red Hat Discovery 1.14 discovery 1.14.3-1748529279fixed: vendor fix RHSA-2025:8385
-
Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass 8.0p1-26.el8_10fixed: vendor fix RHSA-2025:16823
-
Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass 8.7p1-45.el9, pam_ssh_agent_auth 0.10.4-5.45.el9fixed: vendor fix RHSA-2025:6993
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) openssh-askpass 8.7p1-38.el9_4.5, pam_ssh_agent_auth 0.10.4-5.38.el9_4.5fixed: vendor fix RHSA-2025:3837
-
Red Hat Enterprise Linux BaseOS (v. 8) openssh 8.0p1-26.el8_10, openssh-cavs 8.0p1-26.el8_10, openssh-ldap 8.0p1-26.el8_10, openssh-keycat 8.0p1-26.el8_10, openssh-server 8.0p1-26.el8_10, openssh-clients 8.0p1-26.el8_10, +1 morefixed: vendor fix RHSA-2025:16823
-
Red Hat Enterprise Linux BaseOS (v. 9) openssh 8.7p1-45.el9, openssh-keycat 8.7p1-45.el9, openssh-server 8.7p1-45.el9, openssh-clients 8.7p1-45.el9fixed: vendor fix RHSA-2025:6993
show 2 moreshow fewer
-
Red Hat Enterprise Linux BaseOS EUS (v.9.4) openssh 8.7p1-38.el9_4.5, openssh-keycat 8.7p1-38.el9_4.5, openssh-server 8.7p1-38.el9_4.5, openssh-clients 8.7p1-38.el9_4.5fixed: vendor fix RHSA-2025:3837
-
Red Hat Discovery 1.14 discovery 1.14.2-1748467619 Red Hat Enterprise Linux 10 opensshnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-202-04 updated cvss 6.8
Siemens SIDIS Secured SmartPlug
-
Siemens SIDIS Secured SmartPlug < 7.26.0310affected: fixed in V7.26.0310
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-25-162-05 updated cvss 6.8
Siemens SIMATIC S7-1500 CPU family
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
7.72% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- seclists.org https://seclists.org/oss-sec/2025/q1/144 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | OpenSSH_jll | <9.9.1+0 |
9.9.1+0 |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat Discovery 1.14
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat OpenShift Container Platform 4
- Siemens SIDIS Secured SmartPlug
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-390 Detection of Error Condition Without Action
References
-
ftp.openbsd.org
/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
patch, web
-
seclists.org
/oss-sec/2025/q1/144
exploit, mailing-list, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2025:16823
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:3837
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:6993
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:8385
vendor-advisory, web
-
access.redhat.com
/security/cve/CVE-2025-26465
vdb-entry, third-party-advisory, web
-
access.redhat.com
/solutions/7109879
web
-
bugzilla.redhat.com
/show_bug.cgi?id=2344780
issue-tracking, third-party-advisory, web
-
lists.debian.org
/debian-lts-announce/2025/02/msg00020.html
third-party-advisory, web
-
openwall.com
/lists/oss-security/2025/02/18/1
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2025/02/18/4
mailing-list, third-party-advisory, web
-
theregister.com
/2025/02/18/openssh_vulnerabilities_mitm_dos/
press/media-coverage, web
-
bugzilla.suse.com
/show_bug.cgi?id=1237040
issue-tracking, web
-
security-tracker.debian.org
/tracker/CVE-2025-26465
third-party-advisory, web
-
ubuntu.com
/security/CVE-2025-26465
third-party-advisory, web
-
openssh.com
/releasenotes.html#9.9p2
release-notes, web
-
blog.qualys.com
/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465
third-party-advisory, web
-
lists.mindrot.org
/pipermail/openssh-unix-announce/2025-February/000161.html
third-party-advisory, web
-
security.netapp.com
/advisory/ntap-20250228-0003/
third-party-advisory, web
-
vicarius.io
/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh
third-party-advisory, web
-
vicarius.io
/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh
mitigation, third-party-advisory, web
-
seclists.org
/fulldisclosure/2025/May/8
web
-
seclists.org
/fulldisclosure/2025/May/7
web
-
seclists.org
/fulldisclosure/2025/Feb/18
web
-
cert-portal.siemens.com
/productcert/html/ssa-082556.html
web
-
cert-portal.siemens.com
/productcert/html/ssa-585531.html
web
Sources
- CVE List CVE-2025-26465
- NVD CVE-2025-26465
- OSV JLSEC-2026-72
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.