{"id":"CVE-2025-26466","title":"A flaw was found in the OpenSSH package","summary":"A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770","CWE-770"],"vendor":"openbsd","product":"openssh","affected":["openssh = 9.5","openssh = 9.6","openssh = 9.7","openssh = 9.8","openssh = 9.9","ubuntu_linux = 24.04","ubuntu_linux = 24.10","debian_linux = 11.0","debian_linux = 12.0","debian_linux = 13.0"],"published":"2025-02-28","updated":"2026-06-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-26466","references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-26466","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345043","label":"secalert@redhat.com"},{"url":"https://seclists.org/oss-sec/2025/q1/144","label":"secalert@redhat.com"},{"url":"https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt","label":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2025/Feb/18","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2025/May/7","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2025/May/8","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1237041","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26466","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20250228-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://ubuntu.com/security/CVE-2025-26466","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openwall.com/lists/oss-security/2025/02/18/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openwall.com/lists/oss-security/2025/02/18/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available"],"epss":0.39845,"epssPercentile":0.98601,"ingestedAt":"2026-06-29T13:24:34.173Z","exploits":{"github":4,"githubRepos":["https://github.com/rxerium/CVE-2025-26466","https://github.com/mrowkoob/CVE-2025-26466-msf","https://github.com/tpirate/CVE-2025-26466"],"checkedAt":"2026-09-21T15:27:18.332Z"},"exploitAvailable":true,"slug":"CVE-2025-26466","body":"## Overview\n\nA flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.\n\n## Affected\n\n- `openssh = 9.5`\n- `openssh = 9.6`\n- `openssh = 9.7`\n- `openssh = 9.8`\n- `openssh = 9.9`\n- `ubuntu_linux = 24.04`\n- `ubuntu_linux = 24.10`\n- `debian_linux = 11.0`\n- `debian_linux = 12.0`\n- `debian_linux = 13.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":52,"depthScoreParts":{"impact":32.5,"likelihood":8,"exploitation":12,"ransomware":0},"changes":[{"seq":4803,"id":"CVE-2025-26466","ts":1788887207794,"field":"exploit_available","old":"false","new":"true"},{"seq":3686,"id":"CVE-2025-26466","ts":1788886324415,"field":"exploit_available","old":"true","new":"false"},{"seq":2533,"id":"CVE-2025-26466","ts":1788883004162,"field":"exploit_available","old":"false","new":"true"},{"seq":1562,"id":"CVE-2025-26466","ts":1788882405590,"field":"exploit_available","old":"true","new":"false"},{"seq":676,"id":"CVE-2025-26466","ts":1788881843373,"field":"exploit_available","old":"false","new":"true"}]}