CVE-2025-26465
CVE-2025-26465 · Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
CVSS 6.8 · Medium · EPSS 7.7% · Fix available
- Published
- Updated
Affected products and versions
red hat enterprise linux 8
- Versions
- ≥ 0:8.0p1-26.el8_10: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:8.7p1-45.el9: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 extended update support
- Versions
- ≥ 0:8.7p1-38.el9_4.5: Not affected (rpm)
No fix published
red hat discovery 1.14
- Versions
- ≥ 1.14.3-1748529279: Not affected (rpm)
No fix published
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat openshift container platform 4
No fix published
openssh Debian:12
- Versions
- 1:9.2p1-2
- 1:9.2p1-2+deb12u1
- 1:9.2p1-2+deb12u2
- 1:9.2p1-2+deb12u3
- 1:9.2p1-2+deb12u4
- Affected ranges
- ECOSYSTEM: < 1:9.2p1-2+deb12u5
Update to 1:9.2p1-2+deb12u5
openssh Debian:13
- Affected ranges
- ECOSYSTEM: < 1:9.9p2-1
Update to 1:9.9p2-1
openssh Debian:14
- Affected ranges
- ECOSYSTEM: < 1:9.9p2-1
Update to 1:9.9p2-1
openssh Ubuntu:Pro:16.04:LTS
- Versions
- 1:6.9p1-2
- 1:6.9p1-3
- 1:7.1p1-1
- 1:7.1p1-3
- 1:7.1p1-4
- 1:7.1p1-6
- 1:7.1p2-1
- 1:7.1p2-2
- 1:7.2p1-1
- 1:7.2p2-1
- 1:7.2p2-2
- 1:7.2p2-3
- 1:7.2p2-4
- 1:7.2p2-4ubuntu1
- 1:7.2p2-4ubuntu2.1
- 1:7.2p2-4ubuntu2.2
- 1:7.2p2-4ubuntu2.4
- 1:7.2p2-4ubuntu2.5
- 1:7.2p2-4ubuntu2.6
- 1:7.2p2-4ubuntu2.7
- 1:7.2p2-4ubuntu2.8
- 1:7.2p2-4ubuntu2.10
- 1:7.2p2-4ubuntu2.10+esm1
- 1:7.2p2-4ubuntu2.10+esm2
- 1:7.2p2-4ubuntu2.10+esm3
- 1:7.2p2-4ubuntu2.10+esm4
- 1:7.2p2-4ubuntu2.10+esm5
- 1:7.2p2-4ubuntu2.10+esm6
- Affected ranges
- ECOSYSTEM: < 1:7.2p2-4ubuntu2.10+esm7
Update to 1:7.2p2-4ubuntu2.10+esm7
openssh Ubuntu:Pro:FIPS-updates:16.04:LTS
- Versions
- 1:7.2p2-4ubuntu2.fips.2.2.3
- 1:7.2p2-4ubuntu2.fips.2.4.1
- 1:7.2p2-4ubuntu2.fips.2.4.2
- 1:7.2p2-4ubuntu2.fips.2.8.1
- 1:7.2p2-4ubuntu2.fips.2.10.1
- 1:7.2p2-4ubuntu2.fips.2.10.2
- 1:7.2p2-4ubuntu2.fips.2.10.3
- 1:7.2p2-4ubuntu2.fips.2.10.4
- 1:7.2p2-4ubuntu2.fips.2.10.5
- 1:7.2p2-4ubuntu2.fips.2.10.6
- Affected ranges
- ECOSYSTEM: < 1:7.2p2-4ubuntu2.fips.2.10.7
Update to 1:7.2p2-4ubuntu2.fips.2.10.7
openssh Ubuntu:Pro:FIPS:16.04:LTS
- Versions
- 1:7.2p2-4ubuntu2.fips.2.2
- 1:7.2p2-4ubuntu2.fips.2.2.1
- 1:7.2p2-4ubuntu2.fips.2.10.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openssh Ubuntu:Pro:18.04:LTS
- Versions
- 1:7.5p1-10
- 1:7.6p1-4
- 1:7.6p1-4ubuntu0.1
- 1:7.6p1-4ubuntu0.2
- 1:7.6p1-4ubuntu0.3
- 1:7.6p1-4ubuntu0.5
- 1:7.6p1-4ubuntu0.6
- 1:7.6p1-4ubuntu0.7
- 1:7.6p1-4ubuntu0.7+esm1
- 1:7.6p1-4ubuntu0.7+esm2
- 1:7.6p1-4ubuntu0.7+esm3
- Affected ranges
- ECOSYSTEM: < 1:7.6p1-4ubuntu0.7+esm4
Update to 1:7.6p1-4ubuntu0.7+esm4
openssh-ssh1 Ubuntu:18.04:LTS
- Versions
- 1:7.5p1-8
- 1:7.5p1-9
- 1:7.5p1-9build1
- 1:7.5p1-10
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openssh Ubuntu:Pro:FIPS-updates:18.04:LTS
- Versions
- 1:7.9p1-10~ubuntu18.04.fips.0.1
- 1:7.9p1-10~ubuntu18.04.fips.0.2
- 1:7.9p1-10~ubuntu18.04.fips.0.3
- 1:7.9p1-10~ubuntu18.04.fips.0.4
- 1:7.9p1-10~ubuntu18.04.fips.0.5
- 1:7.9p1-10~ubuntu18.04.fips.0.6
- 1:7.9p1-10~ubuntu18.04.fips.0.7
- 1:7.9p1-10~ubuntu18.04.fips.0.8
- 1:7.9p1-10~ubuntu18.04.fips.0.9
- Affected ranges
- ECOSYSTEM: < 1:7.9p1-10~ubuntu18.04.fips.0.10
Update to 1:7.9p1-10~ubuntu18.04.fips.0.10
openssh Ubuntu:Pro:FIPS:18.04:LTS
- Versions
- 1:7.9p1-10~ubuntu18.04.fips.0.1
- 1:7.9p1-10~ubuntu18.04.fips.0.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openssh Ubuntu:20.04:LTS
- Versions
- 1:8.0p1-6build1
- 1:8.1p1-1
- 1:8.1p1-5
- 1:8.2p1-4
- 1:8.2p1-4ubuntu0.1
- 1:8.2p1-4ubuntu0.2
- 1:8.2p1-4ubuntu0.3
- 1:8.2p1-4ubuntu0.4
- 1:8.2p1-4ubuntu0.5
- 1:8.2p1-4ubuntu0.7
- 1:8.2p1-4ubuntu0.8
- 1:8.2p1-4ubuntu0.9
- 1:8.2p1-4ubuntu0.10
- 1:8.2p1-4ubuntu0.11
- Affected ranges
- ECOSYSTEM: < 1:8.2p1-4ubuntu0.12
Update to 1:8.2p1-4ubuntu0.12
openssh-ssh1 Ubuntu:20.04:LTS
- Versions
- 1:7.5p1-11build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openssh Ubuntu:Pro:FIPS-updates:20.04:LTS
- Versions
- 1:8.2p1-4ubuntu0.fips.0.2.1
- 1:8.2p1-4ubuntu0.fips.0.4.0
- 1:8.2p1-4ubuntu0.fips.0.5.0
- 1:8.2p1-4ubuntu0.fips.0.7
- 1:8.2p1-4ubuntu0.fips.0.8
- 1:8.2p1-4ubuntu0.fips.0.9
- 1:8.2p1-4ubuntu0.fips.0.10
- 1:8.2p1-4ubuntu0.fips.0.11
- Affected ranges
- ECOSYSTEM: < 1:8.2p1-4ubuntu0.fips.0.12
Update to 1:8.2p1-4ubuntu0.fips.0.12
openssh Ubuntu:Pro:FIPS:20.04:LTS
- Versions
- 1:8.2p1-4ubuntu0.fips.0.2.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openssh Ubuntu:22.04:LTS
- Versions
- 1:8.4p1-6ubuntu2
- 1:8.7p1-2
- 1:8.7p1-2build1
- 1:8.7p1-4
- 1:8.8p1-1
- 1:8.9p1-3
- 1:8.9p1-3ubuntu0.1
- 1:8.9p1-3ubuntu0.3
- 1:8.9p1-3ubuntu0.4
- 1:8.9p1-3ubuntu0.5
- 1:8.9p1-3ubuntu0.6
- 1:8.9p1-3ubuntu0.7
- 1:8.9p1-3ubuntu0.10
- Affected ranges
- ECOSYSTEM: < 1:8.9p1-3ubuntu0.11
Update to 1:8.9p1-3ubuntu0.11
openssh-ssh1 Ubuntu:22.04:LTS
- Versions
- 1:7.5p1-12
- 1:7.5p1-12build1
- 1:7.5p1-13
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2025:16823
- https://access.redhat.com/errata/RHSA-2025:3837
- https://access.redhat.com/errata/RHSA-2025:6993
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2025-26465
- https://access.redhat.com/solutions/7109879
- https://bugzilla.redhat.com/show_bug.cgi?id=2344780
- https://seclists.org/oss-sec/2025/q1/144
- https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html
- https://www.openwall.com/lists/oss-security/2025/02/18/1
- https://www.openwall.com/lists/oss-security/2025/02/18/4
- https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
- https://bugzilla.suse.com/show_bug.cgi?id=1237040
- https://security-tracker.debian.org/tracker/CVE-2025-26465
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
- https://ubuntu.com/security/CVE-2025-26465
- https://www.openssh.com/releasenotes.html#9.9p2
- https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html
- https://security.netapp.com/advisory/ntap-20250228-0003/
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh
- http://seclists.org/fulldisclosure/2025/May/8
- https://nvd.nist.gov/vuln/detail/CVE-2025-26465