AI description
CVE-2025-26465 is a vulnerability in the OpenSSH client that can allow a man-in-the-middle (MitM) attack when the `VerifyHostKeyDNS` option is enabled. This option allows the client to verify the server's identity against DNS records. Due to a logic error in how the server's identity is verified when memory allocation errors occur, an attacker can potentially bypass these checks and impersonate the intended server. This could lead to the theft of sensitive information, such as credentials. While the `VerifyHostKeyDNS` option is currently disabled by default, it was previously enabled by default in certain environments like FreeBSD between September 2013 and March 2023. Administrators are encouraged to review their configurations to ensure this option is not enabled unless specifically required. The vulnerability has existed since late 2014 and highlights the importance of regularly reviewing and updating security configurations.
- Description
- A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
- Source
- secalert@redhat.com
- NVD status
- Received
CVSS 3.1
- Type
- Secondary
- Base score
- 6.8
- Impact score
- 5.2
- Exploitability score
- 1.6
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Severity
- MEDIUM
- secalert@redhat.com
- CWE-390
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
2
CVE-2025-26465 and CVE-2025-26466 allow attackers to execute #MitM and #DoS attacks. These flaws impact OpenSSH clients and servers, making it possible for adversaries to intercept SSH connections or cause service disruptions. https://t.co/F9Z8CnpGyr https://t.co/lnTXDVDkXB
@provintell
20 Feb 2025
8 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 New OpenSSH vulnerabilities found! 🔸 CVE-2025-26465: MitM attacks if VerifyHostKeyDNS is enabled 🔸 CVE-2025-26466: DoS attacks disrupting servers Public exploit code is out — update to OpenSSH 9.9p2! 💻 #Deepweb #Darkweb Breaking news from the world… https://t.co/ZF7G3lwjoe
@godeepweb
20 Feb 2025
43 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
#OpenSSH 推出 9.9p2 版修复安全漏洞，其中 CVE-2025-26465 漏洞可在无需用户交互的情况下发起中间人劫持。 这个漏洞主要影响的是 FreeBSD、SUSE、Alpine Linux等，建议使用 OpenSSH 的话都更新到最新版。 查看全文：https://t.co/cGHIwPdECN
@landiantech
20 Feb 2025
254 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
New OpenSSH Flaws Expose Servers to MiTM & DoS Attacks! OpenSSH 9.9p2 patches: 🔹 CVE-2025-26465 – A MitM flaw exploiting 'VerifyHostKeyDNS' to hijack SSH sessions. 🔹 CVE-2025-26466 – A DoS flaw flooding systems with small ping messages. 📢 Update now! Disable… https://t.
@dCypherIO
20 Feb 2025
38 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Actively exploited CVE : CVE-2025-26465
@transilienceai
20 Feb 2025
15 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Two new OpenSSH vulnerabilities (CVE-2025-26465 & CVE-2025-26466) pose risks of MitM and DoS attacks. Patches are available in version 9.9p2. Update is crucial for security! 🔒 #OpenSSH #EnterpriseSecurity #USA link: https://t.co/IVrT2JwjpS https://t.co/Gwhxib6Jvl
@TweetThreatNews
19 Feb 2025
18 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Looks like OpenSSH has a couple of unexpected guests crashing the party! New vulnerabilities (CVE-2025-26465 & CVE-2025-26466) are here, enabling some sneaky Man-in-the-Middle and pesky DoS attacks. Read more: https://t.co/I3sxFYnn4l https://t.co/7REWshkf76
@Stealthiss_
19 Feb 2025
31 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🦹🏻♀️🪽 Villain of the Week 🪽🦹🏻♀️ CVE-2025-26465 is a vulnerability that has been identified in the OpenSSH client (versions 6.8p1 through 9.9p1) when the VerifyHostKeyDNS option is enabled (whether it is set to 'yes' or 'ask'.). This flaw allows attackers to bypass server
@vicariusltd
19 Feb 2025
62 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Vulnerability Alert: OpenSSH Vulnerabilities Allowing MitM and DoS Attacks 📅 Timeline: Disclosure: 2025-02-18, Patch: 2025-02-18 📌 Attribution: Qualys TRU 🆔cveId: CVE-2025-26465, CVE-2025-26466 🛠️exploitMaturity: Not Available 📂affectedVersions: 6.8p1 - 9.9p1… https://
@syedaquib77
19 Feb 2025
45 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Vulnerability Alert: OpenSSH Vulnerabilities Allowing MitM and DoS Attacks 📅 Timeline: Disclosure: 2025-02-18, Patch: 2025-02-18 📌 Attribution: Qualys TRU 🆔cveId: CVE-2025-26465, CVE-2025-26466 cvssSeverity: [Critical 🔴, High 🟠, Medium 🟡, Low 🟢] 🛠️exploitMaturity:…
@syedaquib77
19 Feb 2025
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Załataliście już swoje OpenSSH? Wyszły dwie podatności w OpenSSH: CVE-2025-26465 i CVE-2025-26466 - warto rzucić okiem, czy Wasza Ulubiona Dystrybucja to załatała, a w szczególności czy Wasz dostawca systemów wbudowanych przypadkiem nie używa dalej OpenSSH w dziurawej wersji.
@komputerow
19 Feb 2025
881 Impressions
1 Retweet
13 Likes
0 Bookmarks
5 Replies
1 Quote
🚨 New OpenSSH Vulnerabilities Discovered! 🚨 CVE-2025-26465 enables man-in-the-middle attacks, while CVE-2025-26466 allows denial-of-service exploits. Check if you're vulnerable & secure your system NOW! 🔒 🔗 Read more: https://t.co/wKncCb8IxM #CyberSecurity #OpenSSH #CV
@BaseFortify
19 Feb 2025
52 Impressions
2 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
Wykryto nowe luki w OpenSSH (CVE-2025-26465, CVE-2025-26466), które mogą prowadzić do ataków MITM i DoS. Administratorzy powinni jak najszybciej zaktualizować systemy i sprawdzić konfigurację. #cybersecurity #OpenSSH https://t.co/1KIpArYzkN https://t.co/1KIpArYzkN
@arkady86
19 Feb 2025
14 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
OpenSSH CVE fixes are now available in the new Flatcar Alpha, Beta, Stable, LTS-2024 releases! 🔒 CVE fixes & security patches: OpenSSH (CVE-2025-26465, CVE-2025-26466) 📜 Release notes at the usual spot: https://t.co/rZjTiO6fY2 https://t.co/XjoPhLRVx4
@flatcar
19 Feb 2025
146 Impressions
2 Retweets
4 Likes
0 Bookmarks
0 Replies
0 Quotes
Duas falhas críticas no OpenSSH foram descobertas: CVE-2025-26465 permite ataques de man-in-the-middle e CVE-2025-26466 pode causar negação de serviço. Atualize para a versão 9.9p2 e revise suas configurações! Seu sistema pode estar em risco!
@IncursioHack
19 Feb 2025
19 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
OpenSSHにMiTM攻撃とDoS攻撃の脆弱性：CVE-2025-26465 - Codebook https://t.co/Y551ELVHAK #izumino_trend
@sec_trend
19 Feb 2025
54 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-26465, -26466: Two vulnerabilities in OpenSSH, 6.8 rating❗️ MitM and DoS in OpenSSH. The severity level is medium, but the vulns cover many versions. Search at https://t.co/hv7QKSqxTR: 👉 Link: https://t.co/jrDDvYolhG #cybersecurity #vulnerability_map https://t.co/sW1
@Netlas_io
19 Feb 2025
755 Impressions
2 Retweets
11 Likes
1 Bookmark
0 Replies
1 Quote
🚨Nuevas vulnerabilidades de OpenSSH exponen servidores SSH a ataques MiTM y DoS ➡️ Machine-in-the-middle (MitM) y a Denial of Service ⚠️ CVE-2025-26465 ⚠️ CVE-2025-26466 https://t.co/iUgpYhfKHB… https://t.co/UhRNxBAFwt
@doncaptador
19 Feb 2025
37 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
OpenSSHの重大な脆弱性がDoS 攻撃や中間者攻撃に悪用される可能性(CVE-2025-26465,CVE-2025-26466) #セキュリティ #セキュリティ対策Lab https://t.co/BntcAwPjHK
@securityLab_jp
19 Feb 2025
23 Impressions
1 Retweet
1 Like
0 Bookmarks
0 Replies
0 Quotes
OpenSSH has two new vulnerabilities (CVE-2025-26465, MITM; CVE-2025-26466, DoS). CVE-2025-26465 affects versions 6.8p1-9.9p1, CVE-2025-26466 affects 9.5p1-9.9p1. Upgrade to 9.9p2 immediately to patch. https://t.co/dCqCLYudoD
@Jfreeg_
19 Feb 2025
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Vulnerability Alert: OpenSSH Man-in-the-Middle and DoS Attacks 📅 Timeline: Disclosure: 2025-02-18, Patch: 2025-02-18 🆔cveId: CVE-2025-26465, CVE-2025-26466 cvssSeverity: Critical 🔴 🛠️exploitMaturity: Active exploitation reported 📂affectedVersions: 6.8p1 to 9.9p1… http
@syedaquib77
19 Feb 2025
50 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
🚨Alert🚨 CVE-2025-26465 & CVE-2025-26466: OpenSSH Client & Server Vulnerabilities Enables MiTM & DoS Attacks 🧐Deep Dive from @qualys:https://t.co/ITteNz2l4g 📊 67.1M+Services are found on the https://t.co/ysWb28BTvF yearly. 🔗Hunter Link:https://t.co/P2bN5nlz5b 👇Q
@HunterMapping
19 Feb 2025
1238 Impressions
6 Retweets
14 Likes
4 Bookmarks
0 Replies
0 Quotes
🚨Alert🚨 CVE-2025-26465 & CVE-2025-26466: OpenSSH Client & Server Vulnerabilities Enables MiTM & DoS Attacks 🧐Deep Dive from@qualys:https://t.co/ITteNz2STO 📊 67.1M+Services are found on the https://t.co/ysWb28Crld yearly. 🔗Hunter Link:https://t.co/P2bN5nm6UJ 👇Qu
@HunterMapping
19 Feb 2025
86 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Two OpenSSH vulnerabilities allow MitM and DoS attacks. CVE-2025-26465 lets attackers impersonate servers when VerifyHostKeyDNS is enabled, and CVE-2025-26466 causes a pre-auth DoS. Both are fixed in OpenSSH 9.9p2—patch immediately.#OpenSSH #CVE https://t.co/LIcVW30NA4
@ZaihuaNewsEN
19 Feb 2025
31 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
Actively exploited CVE : CVE-2025-26465
@transilienceai
19 Feb 2025
25 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
New post from https://t.co/uXvPWJy6tj (CVE-2025-26465 | OpenSSH VerifyHostKeyDNS cryptographic issues (Nessus ID 216407)) has been published on https://t.co/0be0tj11SQ
@WolfgangSesin
18 Feb 2025
23 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
OpenSSHの新たな脆弱性（CVE-2025-26465、CVE-2025-26466）が発見され、MitM攻撃とDoS攻撃が可能に。影響を受けるバージョンは2014年以降のものが含まれ、最新版9.9p2で修正済み。PoCコードも公開され、早急なアップデートが推奨される。 https://t.co/58WRL2IpNO
@01ra66it
18 Feb 2025
1394 Impressions
9 Retweets
24 Likes
9 Bookmarks
0 Replies
1 Quote
OpenSSHに2つの脆弱性（CVE-2025-26465、CVE-2025-26466）が発見され、MitM攻撃やDoS攻撃が可能に。特に、VerifyHostKeyDNSを有効にするとサーバーのなりすましが可能になる。OpenSSH 9.9p2で修正済み。 https://t.co/V3yvbHAU5k
@01ra66it
18 Feb 2025
562 Impressions
3 Retweets
11 Likes
2 Bookmarks
0 Replies
0 Quotes
🚨Nuevas vulnerabilidades de OpenSSH exponen servidores SSH a ataques MiTM y DoS ➡️ Machine-in-the-middle (MitM) y a Denial of Service ⚠️ CVE-2025-26465 ⚠️ CVE-2025-26466 https://t.co/b1Pfxjbch9 https://t.co/7fe19Egy3i
@elhackernet
18 Feb 2025
6574 Impressions
75 Retweets
134 Likes
38 Bookmarks
1 Reply
0 Quotes
CVE-2025-26465 A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating… https://t.co/sXWDNn1trO
@CVEnew
18 Feb 2025
254 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Two critical vulnerabilities have been found in OpenSSH, which could lead to a machine-in-the-middle (MitM) attack and a denial-of-service (DoS) attack if exploited under certain conditions. 🔴 CVE-2025-26465: Enables a MitM attack on the OpenSSH client if the VerifyHostKeyDNS…
@cytexsmb
18 Feb 2025
204 Impressions
1 Retweet
3 Likes
2 Bookmarks
0 Replies
1 Quote
OpenSSH 9.9p2 fixes two critical flaws: a MitM vulnerability (CVE-2025-26465) in VerifyHostKeyDNS (enabled by default in FreeBSD until 2023) and a DoS flaw (CVE-2025-26466) from excessive memory use. Update immediately. https://t.co/hn3uHKqU7b
@cyberbulletins
18 Feb 2025
65 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Dos vulnerabilidades críticas en OpenSSH identificadas como CVE-2025-26465 y CVE-2025-26466, permiten ataques de máquina en el medio (MitM) contra clientes y exploits de denegación de servicio (DoS) previa a la autenticación dirigidos tanto a clientes como a servidores. 🧉 ht
@MarquisioX
18 Feb 2025
67 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Qualysが、OpenSSHに影響を及ぼす2つの重大な脆弱性を発見しました。これらの脆弱性は、中間者攻撃を仕掛けたりDoS攻撃を引き起こしたりする可能性があります。 ・CVE-2025-26465（中間者攻撃の脆弱性） ・CVE-2025-26466（DoS攻撃の脆弱性） OpenSSH 9.9p2で修正済みです。
@t_nihonmatsu
18 Feb 2025
616 Impressions
2 Retweets
12 Likes
1 Bookmark
1 Reply
0 Quotes
OpenSSHに中間者攻撃(CVE-2025-26465)とDoS (CVE-2025-2646)の脆弱性。前者はVerifyHostKeyDNSオプションが有効な場合のクライアントが脆弱で、2014年10月の作りこみ。後者はクライアントとサーバの双方が脆弱で、2023年8月の作りこみ。 https://t.co/IsmpdYIYpM… https://t.co/LpvJQoMt12
@__kokumoto
18 Feb 2025
2337 Impressions
18 Retweets
36 Likes
6 Bookmarks
0 Replies
0 Quotes
🔴 Two new vulnerabilities found in OpenSSH – one allowing active Man-in-the-Middle (MitM) attacks and the other leading to Denial-of-Service (DoS). Get the details on CVE-2025-26465 and CVE-2025-26466: https://t.co/uv7L8xhYLL
@TheHackersNews
18 Feb 2025
20695 Impressions
127 Retweets
256 Likes
59 Bookmarks
3 Replies
6 Quotes
🚨 Critical OpenSSH Vulnerabilities – Patch Prioritization KQL to identify all your internet facing OpenSSH servers vulnerable to CVE-2025-26466 and CVE-2025-26465. Get your engineers prioritize patching these servers to version 9.9p2 that is released today. Shields Up Scotty! h
@0x534c
18 Feb 2025
3168 Impressions
9 Retweets
50 Likes
33 Bookmarks
2 Replies
1 Quote
OpenSSH Flaws CVE-2025-26465 & CVE-2025-26466 Expose Clients and Servers to Attacks https://t.co/eSiPlVBatG
@Dinosn
18 Feb 2025
12433 Impressions
86 Retweets
206 Likes
63 Bookmarks
6 Replies
2 Quotes
Two vulnerabilities fixed in #OpenSSH : CVE-2025-26465 and CVE-2025-26466 https://t.co/LppMvoA5YS
@nintechnet
18 Feb 2025
83 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
📡 OpenSSH’de Kritik Güvenlik Açıkları: CVE-2025-26465 ve CVE-2025-26466 🔴 CVE-2025-26465 → MITM saldırılarına izin veriyor! 🔴 CVE-2025-26466 → SSH sunucularını çökerten DoS saldırıları mümkün! 📌 Etkilenen Sürümler: •6.8p1 - 9.9p1 (MITM - CVE-2025-26465) •9.5p1 - 9.9p1… http
@tweetozof
18 Feb 2025
115 Impressions
0 Retweets
1 Like
1 Bookmark
0 Replies
0 Quotes
Qualys TRU Discovers Two #Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466 #cybersecurity The Qualys Threat #Research Unit (TRU) has identified two #vulnerabilities in OpenSSH.... https://t.co/QStg7u0yGF
@CyberMeowly
18 Feb 2025
11 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
#OpenSSH Flaws CVE-2025-26465 & CVE-2025-26466 Expose Clients and Servers to Attacks Understand the implications of CVE-2025-26465 & CVE-2025-26466 on OpenSSH. Learn about the risks of machine-in-the-middle and DoS attacks https://t.co/zKAo1uEFDh
@the_yellow_fall
18 Feb 2025
76 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes