Overview
Security researchers have just discovered a serious vulnerability in OpenSSH that can be exploited to carry out Man-in-the-Middle (MitM) and Denial of Service (DoS) attacks. This is a major issue because OpenSSH is one of the most widely used secure communication tools on the internet, commonly used in Linux, macOS, and some Windows systems.
According to Qualys TRU (Threat Research Unit) - a Threat Research Unit of Qualys, two vulnerabilities related to this attack campaign have been identified:
CVE-2025-26465: This vulnerability allows attackers to perform Man-in-the-Middle (MitM) attacks by impersonating a legitimate server.
CVE-2025-26466: This vulnerability allows for Denial of Service (DoS) attacks before authentication.
Introduction to the Vulnerability
CVE-2025-26465: Machine-in-the-Middle (MITM) Attack on OpenSSH Client
CVE-2025-26466: Denial of Service (DoS) Attack on Both Client & Server
Severity: High
Impact:
Pre-authentication DoS attack, causing the system to consume resources (RAM, CPU), disrupting SSH services.
May prevent administrators from logging in, halting critical operations.
Affected Versions
Vulnerability Analysis
CVE-2025-26465
Man-in-the-Middle (MitM) attack is a technique where an attacker inserts themselves between the connection of a client and a server to steal information or impersonate identities. In OpenSSH, MitM can occur if server key authentication is not done correctly.
Initially, for attackers to exploit this vulnerability, the VerifyHostKeyDNS option must be enabled. Specifically, the function sshkey_to_base64().
This Base64 code is responsible for converting an SSH key into Base64 format, which may relate to CVE-2025-26465 if it mishandles data during server key verification.
The variable r is initially set to SSH_ERR_INTERNAL_ERROR, but if there's an error in sshkey_putb() or sshbuf_dtob64_string(), the function will goto out without freeing memory.
If sshbuf_dtob64_string() fails (NULL), it returns SSH_ERR_ALLOC_FAIL, but it may not handle all exception cases.
If an attacker can control the value passed into sshkey_to_base64(), they can exploit this flaw to corrupt memory or cause data leaks in OpenSSH.
Ultimately, once the exploit is successful, attackers can steal credentials and take control of the session.
CVE-2025-26466
The vulnerability CVE-2025-26466 in OpenSSH allows attackers to perform a denial-of-service (DoS) attack before authentication by exploiting asymmetric resource consumption of memory and CPU.
Initially, attackers exploit CVE-2025-26466 by sending a series of SSH2_MSG_PING packets to the server. Each packet causes the server to create an SSH2_MSG_PONG packet and store it in memory before sending it.
By continuously sending requests, and if the number of PING packets is large enough, the server's memory can be exhausted, leading to a denial of service.
Besides consuming the victim's system memory, attackers also target the CPU.
After completing the key exchange process, the server processes the stored SSH2_MSG_PONG packets. This is done inefficiently, leading to a spike in CPU usage when handling a large number of packets, causing service disruption.
Signs to Recognize
Signs to Recognize CVE-2025-26465 Attack
Signs to Recognize CVE-2025-26466 Attack
Recommendations
CVE-2025-26465 - Man-in-the-Middle Attack
Update to OpenSSH 9.9p2 or later.
Disable VerifyHostKeyDNS if it's not really necessary.
Use manual SSH fingerprint to verify the server.
CVE-2025-26466 - Denial of Service Attack
Update to OpenSSH 9.9p2 or later.
Configure SSH connection limits using MaxStartups, LoginGraceTime, PerSourcePenalties.
Monitor SSH traffic to detect unusual behavior.
Conclusion
Security researchers have discovered two critical vulnerabilities in OpenSSH, allowing attackers to perform Man-in-the-Middle (MitM) and Denial of Service (DoS) attacks. These vulnerabilities pose serious risks to public SSH servers and systems using OpenSSH. Updating to the latest version and applying security measures will help reduce the risk of attacks.
References
New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now
Qualys TRU Discovers Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466 | Qualys Security Blog
qualys.com/2025/02/18/openssh-mitm-dos.txt
OpenSSH Vulnerabilities CVE-2025-26465 and CVE-2025-26466 Enable Man-in-the-Middle and DoS Attacks - Upwind
