Search for vulnerabilities
Vulnerability details: VCID-gpc3-ygwj-ffdk
Vulnerability ID VCID-gpc3-ygwj-ffdk
Aliases CVE-2025-26465
Summary A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Status Published
Exploitability 0.5
Weighted Severity 6.1
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-390 Detection of Error Condition Without Action
System Score Found at
cvssv3.1 6.8 https://access.redhat.com/errata/RHSA-2025:3837
ssvc Track* https://access.redhat.com/errata/RHSA-2025:3837
cvssv3.1 6.8 https://access.redhat.com/errata/RHSA-2025:6993
ssvc Track* https://access.redhat.com/errata/RHSA-2025:6993
cvssv3.1 6.8 https://access.redhat.com/errata/RHSA-2025:8385
ssvc Track* https://access.redhat.com/errata/RHSA-2025:8385
cvssv3 6.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-26465.json
cvssv3.1 6.8 https://access.redhat.com/security/cve/CVE-2025-26465
ssvc Track* https://access.redhat.com/security/cve/CVE-2025-26465
epss 0.43264 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.43264 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.52936 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.56435 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
epss 0.56435 https://api.first.org/data/v1/epss?cve=CVE-2025-26465
cvssv3.1 6.8 https://bugzilla.redhat.com/show_bug.cgi?id=2344780
ssvc Track* https://bugzilla.redhat.com/show_bug.cgi?id=2344780
cvssv3.1 6.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.8 https://nvd.nist.gov/vuln/detail/CVE-2025-26465
cvssv3.1 6.8 https://seclists.org/oss-sec/2025/q1/144
ssvc Track* https://seclists.org/oss-sec/2025/q1/144
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-26465.json
https://api.first.org/data/v1/epss?cve=CVE-2025-26465
https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
https://bugzilla.suse.com/show_bug.cgi?id=1237040
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26465
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html
https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html
https://security.netapp.com/advisory/ntap-20250228-0003/
https://security-tracker.debian.org/tracker/CVE-2025-26465
https://ubuntu.com/security/CVE-2025-26465
https://www.openssh.com/releasenotes.html#9.9p2
https://www.openwall.com/lists/oss-security/2025/02/18/1
https://www.openwall.com/lists/oss-security/2025/02/18/4
https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh
https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh
144 https://seclists.org/oss-sec/2025/q1/144
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:/a:redhat:discovery:1.14::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:discovery:1.14::el9
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:openshift:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift:4
cpe:/a:redhat:rhel_eus:9.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/o:redhat:enterprise_linux:10 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/o:redhat:rhel_eus:9.4::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_eus:9.4::baseos
CVE-2025-26465 https://access.redhat.com/security/cve/CVE-2025-26465
CVE-2025-26465 https://nvd.nist.gov/vuln/detail/CVE-2025-26465
RHSA-2025:3837 https://access.redhat.com/errata/RHSA-2025:3837
RHSA-2025:6993 https://access.redhat.com/errata/RHSA-2025:6993
RHSA-2025:8385 https://access.redhat.com/errata/RHSA-2025:8385
show_bug.cgi?id=2344780 https://bugzilla.redhat.com/show_bug.cgi?id=2344780
USN-7270-1 https://usn.ubuntu.com/7270-1/
USN-7270-2 https://usn.ubuntu.com/7270-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:3837
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-19T15:02:09Z/ Found at https://access.redhat.com/errata/RHSA-2025:3837
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:6993
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-19T15:02:09Z/ Found at https://access.redhat.com/errata/RHSA-2025:6993
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:8385
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-19T15:02:09Z/ Found at https://access.redhat.com/errata/RHSA-2025:8385
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-26465.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-26465
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-19T15:02:09Z/ Found at https://access.redhat.com/security/cve/CVE-2025-26465
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2344780
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-19T15:02:09Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2344780
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-26465
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://seclists.org/oss-sec/2025/q1/144
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-19T15:02:09Z/ Found at https://seclists.org/oss-sec/2025/q1/144
Exploit Prediction Scoring System (EPSS)
Percentile 0.97413
EPSS Score 0.43264
Published At Aug. 2, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:39:46.430653+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.18/main.json 37.0.0