CVE-2025-26466Medium· 5.9▾ TwilightPoC availableA flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
38%
38% → 40%
4 GitHub repos
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
openssh = 9.5openssh = 9.6openssh = 9.7openssh = 9.8openssh = 9.9ubuntu_linux = 24.04ubuntu_linux = 24.10debian_linux = 11.0debian_linux = 12.0debian_linux = 13.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-26465Medium· 6.8A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled
CVE-2025-61984Low· 3.6ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used
CVE-2024-6387High· 8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
CVE-2021-41617High· 7.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected
CVE-2025-61985Low· 3.6ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVE-2026-3497Low· 2.7Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions