CVE-2025-26465: OpenBSD OpenSSH DNS Verification DoS Flaw

CVE-2025-26465 Overview

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

Critical Impact

A successful attack can completely compromise a victim's system with high confidentiality and integrity impact.

Affected Products

• openbsd openssh
• netapp active_iq_unified_manager
• netapp ontap

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to openbsd
• Not Available - CVE CVE-2025-26465 assigned
• Not Available - openbsd releases security patch
• 2025-02-18 - CVE CVE-2025-26465 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-26465

Vulnerability Analysis

The vulnerability lies in the mishandling of error codes while using the VerifyHostKeyDNS option in OpenSSH. This can allow an attacker, positioned between the client and server, to impersonate a legitimate server and perform a machine-in-the-middle attack.

Root Cause

Incorrect error code handling during host key verification in OpenSSH.

Attack Vector

Network-based attack with high complexity, requiring interaction with the victim's system to cause memory exhaustion.

// Example exploitation code (sanitized)
#include <stdio.h>
#include <stdlib.h>

int main() {
    char *exhaust_memory = malloc(1024*1024*1024); // Allocate 1GB
    if (exhaust_memory == NULL) {
        fprintf(stderr, "Memory allocation failed\n");
        return 1;
    }
    // Simulate network interaction
    free(exhaust_memory);
    return 0;
}

Detection Methods for CVE-2025-26465

Indicators of Compromise

• Unexpected network traffic with SSH sessions
• Memory exhaustion alerts during SSH client operation
• Unusual error messages in SSH logs

Detection Strategies

Monitor for abnormal SSH traffic patterns and inspect logs for inconsistencies related to the VerifyHostKeyDNS option setting.

Monitoring Recommendations

Utilize SentinelOne to set up alerts for high memory usage on clients using SSH. Regularly review SSH logs for any suspicious activity.

How to Mitigate CVE-2025-26465

Immediate Actions Required

• Disable the VerifyHostKeyDNS option in ssh_config
• Monitor for unusual SSH activity
• Limit network exposure of SSH servers

Patch Information

Apply the latest patches from OpenBSD for OpenSSH as described in vendor advisories.

Workarounds

Disable the use of VerifyHostKeyDNS on all SSH clients:

# Configuration example for /etc/ssh/ssh_config
Host *
    VerifyHostKeyDNS no