--- id: CVE-2023-25136 title: >- OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling summary: >- OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, … severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H' cwe: - CWE-415 vendor: openbsd product: openssh affected: - openssh = 9.1 - fedora = 37 - fedora = 38 - ontap_select_deploy_administration_utility - a250_firmware - 500f_firmware - c250_firmware published: '2023-02-03' updated: '2026-10-14' sourceUpdated: '2026-10-14T23:17:15.010' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-25136' references: - url: 'http://www.openwall.com/lists/oss-security/2023/02/13/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/02/22/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/02/22/2' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/02/23/3' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/03/06/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/03/09/2' label: cve@mitre.org - url: 'https://bugzilla.mindrot.org/show_bug.cgi?id=3522' label: cve@mitre.org - url: 'https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig' label: cve@mitre.org - url: >- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 label: cve@mitre.org - url: >- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ label: cve@mitre.org - url: 'https://news.ycombinator.com/item?id=34711565' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202307-01' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20230309-0003/' label: cve@mitre.org - url: 'https://www.openwall.com/lists/oss-security/2023/02/02/2' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/02/13/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/02/22/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/02/22/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/02/23/3' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/03/06/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/03/09/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.mindrot.org/show_bug.cgi?id=3522' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://news.ycombinator.com/item?id=34711565' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202307-01' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20230309-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openwall.com/lists/oss-security/2023/02/02/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd - exploit-available - cve.org epss: 0.89685 epssPercentile: 0.99789 exploits: github: 11 githubRepos: - 'https://github.com/jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free' - 'https://github.com/ticofookfook/CVE-2023-25136' - 'https://github.com/Christbowel/CVE-2023-25136' checkedAt: '2026-10-15T00:02:42.044Z' exploitAvailable: true ingestedAt: '2026-10-15T00:02:07.125Z' ssvc: exploitation: poc automatable: 'no' technicalImpact: partial timestamp: '2024-02-27T17:36:59.947126Z' --- ## Overview OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible." ## Affected - `openssh = 9.1` - `fedora = 37` - `fedora = 38` - `ontap_select_deploy_administration_utility` - `a250_firmware` - `500f_firmware` - `c250_firmware` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.