CVE-2025-26466: OpenBSD OpenSSH DOS Vulnerability

CVE-2025-26466 Overview

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

Critical Impact
This vulnerability can lead to a denial of service by exhausting server resources.

Affected Products

openbsd openssh
canonical ubuntu_linux
debian debian_linux

Discovery Timeline

2025-02-28 - CVE CVE-2025-26466 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-26466

Vulnerability Analysis

The vulnerability involves a memory leak through the handling of 'ping' packets by the OpenSSH server. Each packet causes a corresponding 'pong' response to be stored in memory until the key exchange concludes. Without release of these allocations, an attacker can overwhelm the server's resources.

Root Cause

The root cause is inadequate management of memory allocation and deallocation for packets intended for key exchange operations.

Attack Vector

Network-based attacks can exploit this vulnerability by sending repeated SSH ping packets.

cpp

// Example exploitation code (sanitized)
#include <ssh/ssh.h>

int main() {
    ssh_session my_ssh_session = ssh_new();
    // Configure session
    ssh_options_set(my_ssh_session, SSH_OPTIONS_HOST, "target_server");

    // Connect to server
    ssh_connect(my_ssh_session);

    // Send multiple ping packets
    for (int i = 0; i < 10000; i++) {
        ssh_send_ping(my_ssh_session);
    }

    ssh_disconnect(my_ssh_session);
    ssh_free(my_ssh_session);
    return 0;
}

Detection Methods for CVE-2025-26466

Indicators of Compromise

Unusual increase in memory usage on SSH servers
Increased network traffic due to repeated ping requests
SSH server crashes or becomes unresponsive

Detection Strategies

Monitor network traffic for repeated SSH ping requests from the same client. Implement threshold alerts for memory usage spikes on SSH servers.

Monitoring Recommendations

Set resource thresholds and alerting mechanisms within SentinelOne for anomalies in SSH traffic and server resource utilization.

How to Mitigate CVE-2025-26466

Immediate Actions Required

Apply the latest patches from OpenBSD for OpenSSH.
Implement rate-limiting on incoming SSH requests.
Deploy firewall rules to block repeated SSH ping attempts.

Patch Information

OpenBSD has released patches addressing this vulnerability in their latest OpenSSH updates.

Workarounds

Apply rate limiting to SSH sessions to reduce the impact of potential exploitation.

bash

# Configuration example
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent \
    --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent \
    --update --seconds 60 --hitcount 4 -j DROP