CVE-2025-26466: Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466
Published Feb 11, 2025
·Updated
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Other sources
afpfs. The issue was addressed with improved memory handling.
— Apple
afpfs. This issue was addressed with improved checks.
— Apple
Apple Intelligence Reports. A permissions issue was addressed with additional restrictions.
— Apple
AppleJPEG. The issue was addressed with improved input sanitization.
— Apple
Audio. A double free issue was addressed with improved memory management.
— Apple
Credit
Paweł Płatek (Trail(Bits), an anonymous researcher, LFY@@secsys(Fudan University), CVE-2025-26465, CVE-2025-26466, wac, Csaba Fitzl@@theevilbit(Kandji), Dave G., Kirin@@Pwnrin, 7feilee, Eric Dorphy(Twin Cities App Dev LLC), Adam M., Christian Kohlschütter, CVE-2024-8176, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Lyutoon(Atredis Partners), YenKoc(Atredis Partners), Dayton Pidhirney(Atredis Partners), Mateusz Krzywicki@@krzywix, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Lucas Leong@@_wmliang_(Trend Micro Zero Day Initiative), Joseph Ravichandran@@0xjprx(MIT CSAIL), Dillon Franke(Google Project Zero), wac(Trend Micro Zero Day Initiative), Thomas Völkl@@vollkorntomate, SEEMOO, TU Darmstadt, Guilherme Rambo(Best Buddy Apps), Kirin@@Pwnrin(Fudan University), Bohdan Stasiuk@@bohdan_stasiuk, Saagar Jha, Tony Iskow@@Tybbow, Sourabhkumar Mishra, CertiK@@CertiK, @@RenwaX23, Ryan Dowd@@_rdowd, Noah Gregory (wts.dev), Google V8 Security Team, Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Jiming Wang, Jikai Ren, Nan Wang@@eternalsakura13, rheza@@ginggilBesel(Palo Alto Networks), Edouard Bochin@@le_douds(Palo Alto Networks), Tao Yan@@Ga1ois(Palo Alto Networks), Yuhao Hu, Yan Kang, Chenggang Wu, Xiaojie Wei, Ignacio Sanmillan@@ulexec, Ivan Fratric(Google Project Zero), Juergen Schmied(Lynck GmbH), jioundai(360 Vulnerability Research Institute), chen fengjiao(HBC)
Affected Software
60 affected componentsFixes available
F5 BIG-IP Next>=20.2.0<=20.3.0
F5 BIG-IP Next Central Manager>=20.2.0<=20.3.0
Apple macOS Sonoma<14.7.6
14.7.6
Apple macOS Sequoia<15.5
15.5
OpenBSD OpenSSH=9.5-p1
OpenBSD OpenSSH=9.6
OpenBSD OpenSSH=9.6-p1
OpenBSD OpenSSH=9.7
OpenBSD OpenSSH=9.7-p1
OpenBSD OpenSSH=9.8
OpenBSD OpenSSH=9.8-p1
OpenBSD OpenSSH=9.9
OpenBSD OpenSSH=9.9-p1
Canonical Ubuntu Linux=24.04
Canonical Ubuntu Linux=24.10
Debian Debian Linux=11.0
Debian Debian Linux=12.0
Debian Debian Linux=13.0
Microsoft azl3 openssh 9.8p1-3
Microsoft azl3 openssh 9.8p1-4
debian/openssh
1:8.4p1-5+deb11u31:8.4p1-5+deb11u51:9.2p1-2+deb12u71:9.2p1-2+deb12u51:10.0p1-71:10.2p1-5
Fortinet FortiADC=.
Fortinet FortiADCManager=.
Fortinet FortiAIOps>=2.1
Fortinet FortiAIOps>=2.0.1<=2.0.2
Fortinet FortiAnalyzer>=7.6.0<=7.6.2
Fortinet FortiAnalyzer>=7.4.3<=7.4.6
Fortinet FortiAnalyzer>=7.2.5<=7.2.10
Fortinet FortiAnalyzer>=7.0.12<=7.0.14
Fortinet FortiAnalyzer>=6.4.14<=6.4.15
Fortinet FortiAnalyzer-BigData>=7.4.2<=7.4.3
Fortinet FortiAnalyzer-BigData>=7.2.8<=7.2.9
Fortinet FortiDDoS-F>=7.0.1<=7.0.4
Fortinet FortiExtender>=7.6.0<=7.6.2
Fortinet FortiExtender>=7.4.4<=7.4.7
Fortinet FortiExtender=.
Fortinet FortiMail>=7.6.0<=7.6.3
Fortinet FortiMail>=7.4.2<=7.4.5
Fortinet FortiMail>=7.2.6<=7.2.8
Fortinet FortiMail>=7.0.8<=7.0.9
Fortinet FortiManager>=7.6.0<=7.6.2
Fortinet FortiManager>=7.4.3<=7.4.6
Fortinet FortiManager>=7.2.5<=7.2.10
Fortinet FortiManager>=7.0.12<=7.0.14
Fortinet FortiManager>=6.4.14<=6.4.15
Fortinet FortiNDR>=7.6.0<=7.6.1
Fortinet FortiNDR>=7.4.3<=7.4.8
Fortinet FortiNDR=.
Fortinet FortiSandbox>=5.0.0<=5.0.1
Fortinet FortiSandbox>=4.4.4<=4.4.7
Fortinet FortiSandbox>=4.2.7<=4.2.8
Fortinet FortiSwitch>=7.6.0<=7.6.4
Fortinet FortiSwitch>=7.4.4<=7.4.7
Fortinet FortiSwitch>=7.2.8<=7.2.10
Fortinet FortiVoice>=7.2.0<=7.2.1
Fortinet FortiVoice>=7.0.2<=7.0.7
Fortinet FortiVoice>=6.4.9<=6.4.11
Fortinet FortiWeb>=7.6.0<=7.6.4
Fortinet FortiWeb>=7.4.3<=7.4.8
Fortinet FortiWeb=.
Event History
Feb 11, 2025
Data Sourced
via Red Hat·07:55 PM
DescriptionSeverityAffected Software
Feb 18, 2025
News Published
via The Register·03:30 PM
News Published
via The Register·03:33 PM
News Published
via BleepingComputer·05:07 PM
News Published
via BleepingComputer·05:08 PM
Feb 28, 2025
CVE Published
via MITRE·09:25 PM
Data Sourced
via MITRE·09:25 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Mar 1, 2025
Known Exploited
02:54 AM
Mar 2, 2025
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
DescriptionSeverity
Mar 11, 2025
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Apr 16, 2025
Advisory Published
via F5·03:26 PM
May 12, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
May 13, 2025
Advisory Published
via FortiGuard·02:51 PM
Nov 4, 2025
Data Sourced
via Ubuntu·09:13 PM
RemedyDescriptionSeverityAffected Software
Feb 11, 2026
Data Sourced
via Launchpad·06:20 PM
Description
Feb 21, 2026
Data Sourced
via Debian·06:24 PM
DescriptionAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2025-26465
- CVE-2025-31246
- CVE-2025-31240
- CVE-2025-31237
- CVE-2025-31251
- CVE-2025-31235
- CVE-2025-31208
- CVE-2025-31196
- CVE-2025-31209
- CVE-2025-31239
- CVE-2025-31233
- CVE-2025-30453
- CVE-2025-24258
- CVE-2025-30448
- CVE-2025-31232
- CVE-2025-24144
- CVE-2025-31219
- CVE-2025-31241
- CVE-2024-8176
- CVE-2025-30440
- CVE-2025-31222
- CVE-2025-24274
- CVE-2025-24142
- CVE-2025-26466
- CVE-2025-31245
- CVE-2025-31224
- CVE-2025-31221
- CVE-2025-31213
- CVE-2025-31247
- CVE-2025-30442
- CVE-2025-31242
- CVE-2025-31220
- CVE-2025-24155
- CVE-2025-31260
- CVE-2025-24222
- CVE-2025-31212
- CVE-2025-31236
- CVE-2025-30443
- CVE-2025-31226
- CVE-2025-24224
- CVE-2025-31218
- CVE-2025-31256
- CVE-2025-31234
- CVE-2025-31244
- CVE-2025-31258
- CVE-2025-31266
- CVE-2025-31249
- CVE-2025-31259
- CVE-2025-31250
- CVE-2025-31248
- CVE-2025-24213
- CVE-2025-31223
- CVE-2025-31238
- CVE-2025-31215
- CVE-2025-31204
- CVE-2025-24223
- CVE-2025-31206
- CVE-2025-31217
- CVE-2025-31205
- CVE-2025-31257
- CVE-2025-43374
Frequently Asked Questions
1
What is the severity of CVE-2025-26466?
CVE-2025-26466 is classified as a Denial of Service vulnerability due to asymmetric resource consumption affecting memory and CPU.
2
How do I fix CVE-2025-26466?
To mitigate CVE-2025-26466, update to versions 1:9.9p1-3 or later of the OpenSSH package.
3
Which versions of OpenSSH are affected by CVE-2025-26466?
CVE-2025-26466 affects OpenSSH versions up to and including 1:9.9p1-3.
4
Can CVE-2025-26466 be exploited remotely?
Yes, CVE-2025-26466 can be exploited remotely, leading to resource exhaustion on the server.
5
What are the potential impacts of CVE-2025-26466?
The potential impacts of CVE-2025-26466 include service disruption due to excessive consumption of server resources.