Is CVE-2025-26465 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-26465 being exploited in the wild.

How severe is CVE-2025-26465?

Medium severity, with a CVSS score of 6.8, published 18 February 2025.

Which products and versions are affected?

Debian Linux 11.0, 12.0; OpenBSD Openssh 6.9 through 9.8, 9.9, 9.9p1.

Is there a fix for CVE-2025-26465?

A patch was published on 2025-02-18: OpenBSD released patch 008_ssh.patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-26465 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-26465?

Check whether you run Debian Linux or OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-26465: OpenBSD OpenSSH MitM via VerifyHostKeyDNS error mishandling

CVE-2025-26465 · Severity: medium · CVSS 6.8 · Published 2025-02-18

A vulnerability exists in OpenSSH, a widely used tool for secure remote access to servers. When a specific DNS verification setting is enabled, a sophisticated attacker could potentially intercept and manipulate the connection between a user and a server. This could allow the attacker to impersonate a legitimate server to steal sensitive information or credentials, though the attack is difficult to perform as it requires exhausting the target's system memory first.

Technologies: Debian Linux, OpenBSD Openssh. Vendors: Debian, OpenBSD.

Quick answers

Is CVE-2025-26465 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-26465 being exploited in the wild.
How severe is CVE-2025-26465?: Medium severity, with a CVSS score of 6.8, published 18 February 2025.
Which products and versions are affected?: Debian Linux 11.0, 12.0; OpenBSD Openssh 6.9 through 9.8, 9.9, 9.9p1.
Is there a fix for CVE-2025-26465?: A patch was published on 2025-02-18: OpenBSD released patch 008_ssh.patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-26465 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-26465?: Check whether you run Debian Linux or OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability (CWE-390) exists in OpenSSH when the 'VerifyHostKeyDNS' option is enabled. The issue stems from the mishandling of error codes during host key verification via DNS. A remote attacker can perform a machine-in-the-middle (MitM) attack by impersonating a legitimate server. To successfully exploit this, the attacker must first trigger a memory exhaustion condition on the client to influence the error handling path. This high complexity requirement mitigates the risk. Patches have been released by OpenBSD (008_ssh.patch) and various Linux distributions including Red Hat and Debian.

Affected products

OpenBSD OpenSSH 6.9 through 9.8, 9.9, 9.9p1
Red Hat Enterprise Linux 8, 9.4
Debian Debian Linux 11.0, 12.0

Timeline

2025-02-18: disclosed: Vulnerability disclosed by Qualys TRU
2025-02-18: advisory
2025-02-18: patched: OpenBSD released patch 008_ssh.patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.