CVE-2025-26466 Openssh: denial-of-service in openssh

Medium 5.9 Published 28 Feb 2025 Updated 21 Oct 2026

A malicious client can cause OpenSSH server memory exhaustion by sending excessive ping packets, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-26466?

CVE-2025-26466 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

Weakness: CWE-770

Which versions are affected by CVE-2025-26466?

It affects 3 products.

Linux distribution packages (14)

`openssh` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-askpass` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-askpass-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-clients` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-clients-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-debugsource` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-keycat` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-keycat-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-keysign` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-keysign-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-server` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-server-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`
`openssh-sk-dummy-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:9.9p1-7.el10_0`

Products include Canonical Ubuntu Linux, Debian Debian Linux, OpenSSH.

How do I fix CVE-2025-26466?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-26466 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-26466 exists.

Public exploit code: 5 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2025-26466, AZL-56898, BELL-CVE-2025-26466, DEBIAN-CVE-2025-26466, GHSA-m92w-x6j2-5gc5, RHBA-2025:6305 and 1 more.