OpenSSH Vulnerabilities: CVE-2025-26465 and CVE-2025-26466

A recent security advisory from Qualys has uncovered two vulnerabilities in OpenSSH that could put users at risk:

• CVE-2025-26465: A machine-in-the-middle (MitM) attack targeting the OpenSSH client when the VerifyHostKeyDNS option is enabled.
• CVE-2025-26466: A denial-of-service (DoS) attack that affects both OpenSSH clients and servers, leading to excessive memory and CPU consumption.

CVE-2025-26465: MitM Attack on OpenSSH Client

If the VerifyHostKeyDNS option is enabled in OpenSSH, an attacker positioned between the client and server can impersonate the SSH server, bypassing identity verification checks. This means that a user could unknowingly connect to a malicious server, potentially exposing sensitive information.

• This option is disabled by default, but some operating systems (such as FreeBSD) had it enabled by default in the past.
• The vulnerability has existed since December 2014 (OpenSSH 6.8p1).

Recommended Action:

• Ensure VerifyHostKeyDNS is set to no in your SSH configuration unless absolutely necessary.
• Use additional host key verification methods, such as manually verifying fingerprints.

CVE-2025-26466: DoS Attack Against OpenSSH

A second vulnerability allows an attacker to overload OpenSSH clients and servers by consuming excessive memory and CPU resources before authentication.

• Introduced in August 2023 (OpenSSH 9.5p1).
• Can be mitigated on the server side using existing OpenSSH settings:
  • LoginGraceTime: Limits the time allowed for authentication.
  • MaxStartups: Restricts the number of concurrent unauthenticated connections.
  • PerSourcePenalties (OpenSSH 9.8p1+): Reduces the impact of repeated attacks from the same source.

Recommended Action:

• Configure LoginGraceTime and MaxStartups in your sshd_config.
• Upgrade to OpenSSH 9.8p1 or later and enable PerSourcePenalties to mitigate attack risks.

Conclusion

These vulnerabilities highlight the importance of securing SSH configurations. While VerifyHostKeyDNS is not enabled by default, users should verify their settings. Likewise, implementing OpenSSH’s built-in security measures can help defend against DoS attacks. Keeping OpenSSH up to date is the best way to stay protected.

For more details, refer to the official OpenSSH documentation:

• VerifyHostKeyDNS
• LoginGraceTime
• MaxStartups
• PerSourcePenalties

More in depth analysis is also available here: https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt