CVE-2025-26466 Overview
CVE-2025-26466 is a memory consumption flaw in the OpenSSH package affecting both client and server. For each ping packet received during the pre-authentication phase, the SSH process allocates a pong packet in memory and queues it. These buffered responses are only freed after the key exchange completes. A malicious peer can flood the target with ping packets, causing uncontrolled memory growth and triggering a denial of service. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. It impacts OpenSSH versions 9.5p1 through 9.9p1 and was disclosed alongside related research from Qualys on OpenSSH machine-in-the-middle and denial of service issues.
Critical Impact
Unauthenticated remote attackers can exhaust server memory and CPU, rendering the OpenSSH service unavailable to legitimate users.
Affected Products
- OpenBSD OpenSSH versions 9.5p1 through 9.9p1
- Canonical Ubuntu Linux 24.04 LTS and 24.10
- Debian Linux 11, 12, and 13
Discovery Timeline
- 2025-02-28 - CVE-2025-26466 published to the National Vulnerability Database
- 2026-02-10 - Last updated in NVD database
Technical Details for CVE-2025-26466
Vulnerability Analysis
The vulnerability resides in OpenSSH's handling of SSH2_MSG_PING messages during the pre-authentication phase. When the SSH transport layer receives a ping packet, it constructs a pong response and enqueues it in an outbound packet queue. The implementation defers freeing these queued packets until after the SSH key exchange (KEX) completes. An attacker who never advances the key exchange can submit a continuous stream of ping packets, growing the queue indefinitely.
Memory consumption on the target scales linearly with the volume of ping traffic. Both sshd and the OpenSSH client are affected, but exposure is most acute for internet-facing SSH servers. The result is degraded service responsiveness, OOM-killer activity, and process termination.
The CWE classification is [CWE-770: Allocation of Resources Without Limits or Throttling]. The high EPSS probability indicates that exploitation activity is anticipated against unpatched, internet-exposed SSH endpoints.
Root Cause
The root cause is the absence of rate limiting or queue size caps on buffered pong responses prior to authentication. Because freeing only occurs after KEX completion, an attacker who deliberately stalls the handshake can hold allocations indefinitely. The design assumes well-behaved clients will complete the key exchange in a timely manner.
Attack Vector
Exploitation requires only network reachability to the SSH service. The attacker initiates a TCP connection to the target SSH port, negotiates the protocol banner, and begins sending SSH2_MSG_PING messages without completing key exchange. No credentials or user interaction are required. Sustained ping flooding against multiple concurrent connections amplifies memory pressure on the host.
Detailed exploitation context is documented in the Qualys OpenSSH MITM DoS Analysis and the Red Hat CVE-2025-26466 Advisory.
Detection Methods for CVE-2025-26466
Indicators of Compromise
- Sustained inbound connections to TCP port 22 that establish the SSH banner but never complete key exchange.
- High volumes of SSH2_MSG_PING packets observed in network captures from a single or distributed source.
- sshd processes consuming abnormally large amounts of resident memory prior to user authentication.
- Out-of-memory killer entries in /var/log/messages or dmesg terminating sshd workers.
Detection Strategies
- Monitor sshd process memory footprint via ps, top, or cgroup metrics and alert on growth before authentication events.
- Inspect SSH connection durations and flag sessions that remain in the pre-auth state beyond the LoginGraceTime window.
- Deploy the Vicarius Detection Script for CVE-2025-26466 to identify vulnerable OpenSSH versions.
Monitoring Recommendations
- Enable verbose sshd logging (LogLevel VERBOSE) and forward auth logs to a centralized SIEM for correlation.
- Track connection counts per source IP against the SSH service and alert on rapid spikes.
- Watch host-level metrics for unexplained memory pressure correlating with SSH connection volume.
How to Mitigate CVE-2025-26466
Immediate Actions Required
- Upgrade OpenSSH to a vendor-patched release once available for your distribution. Refer to the Ubuntu CVE-2025-26466 Page and Debian CVE-2025-26466 Tracker.
- Restrict SSH exposure to trusted source networks via firewall rules or security groups.
- Reduce LoginGraceTime, MaxStartups, and MaxAuthTries in sshd_config to limit pre-authentication resource use.
Patch Information
Distribution maintainers have published fixed packages addressing the unbounded pong queue allocation. Apply the latest OpenSSH packages from Red Hat, Ubuntu, Debian, SUSE, and NetApp as documented in the Red Hat CVE-2025-26466 Advisory and the NetApp Security Advisory NTAP-20250228-0002. The fix introduces stricter handling of queued ping responses prior to key exchange completion.
Workarounds
- Lower LoginGraceTime (for example, to 30 seconds) so stalled pre-auth sessions are terminated quickly.
- Reduce MaxStartups to throttle concurrent unauthenticated connections to the SSH daemon.
- Place SSH behind a bastion host, VPN, or zero-trust access proxy to remove direct internet exposure.
- Apply per-source rate limiting using iptables, nftables, or fail2ban to constrain ping flood traffic.
# Configuration example: harden sshd_config to reduce pre-auth resource exposure
LoginGraceTime 30
MaxStartups 10:30:60
MaxAuthTries 3
LogLevel VERBOSE
# Restart sshd to apply changes
sudo systemctl restart sshd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
