CVE-2025-61984Low· 3.6▾ TwilightPoC availablessh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 19.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
2 GitHub repos (last check)
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
OpenSSH < 10.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-61985Low· 3.6ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVE-2021-41617High· 7.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected
CVE-2026-55654Low· 3.7A flaw was found in OpenSSH
CVE-2026-3497Low· 2.7Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions
CVE-2024-6387High· 8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
CVE-2025-26465Medium· 6.8A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled