VDB
DEBIAN-CVE-2025-26465
DEBIAN-CVE-2025-26465
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | openssh | 0, 0 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u1, 1:9.2p1-2+deb12u2, 1:9.2p1-2+deb12u3 |
| Debian:14 | openssh | 0, 0 |
| Debian:11 | openssh | *, 0, 8.4 |
Exploit Intelligence
- Patch Manual para a correção das CVE-2025-26465-e-CVE-2025-26466, para sistemas sem update do OpenSSH (github-poc)
- MitM attack allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to it (github-poc)
- CVE-2025-26465.yaml (github-poc)
- cve_db.json (github-poc)
- macos_v2_generated.go (github-poc)
- macos_v1_generated.go (github-poc)
- package.py (github-poc)
Timeline
- Feb 18, 2025 CVE Published
- Apr 28, 2026 CVE Updated