Security readout for executives and security teams
Plain-English summary
CVE-2025-26466 is a denial-of-service flaw in OpenSSH where unauthenticated SSH traffic can make sshd retain growing memory during key exchange. The stated impact is service unavailability, not data theft or code execution. The bundle does not show active exploitation or name a fixed version.
Executive priority
Treat as a moderate availability risk. It is most urgent where SSH is internet-facing or critical to operations. Do not frame it as a breach-risk vulnerability based on the provided evidence; focus on service resilience, vendor status, and patch tracking.
Technical view
The issue is CWE-770: uncontrolled resource allocation. For each SSH ping packet, sshd allocates a pong packet into a queue that is freed only after server/client key exchange completes. A malicious client can keep sending packets, increasing server memory until availability is affected. CVSS is 5.9, network reachable, high attack complexity, no privileges required.
Likely exposure
Exposure is most relevant for systems running affected OpenSSH, especially internet-facing SSH servers. The bundle specifically names OpenSSH 9.5p1 and lists several Red Hat products as unaffected. Distribution-specific status should be checked against each vendor advisory because the bundle does not fully enumerate all fixed or affected package versions.
Exploitation context
The source bundle says KEV is false and provides no cited evidence of active exploitation. The described attack targets availability by exhausting memory during SSH negotiation. It requires network access to the SSH service but is assessed as high complexity in CVSS.
Researcher notes
Evidence supports a pre-authentication memory-consumption DoS in OpenSSH ping/pong handling during key exchange. The bundle lacks a named fixed version and does not prove exploitation in the wild. Validate exposure by package lineage and vendor backport status, not only upstream version strings.
Mitigation direction
- Check OS and OpenSSH vendor advisories for fixed packages or backports.
- Prioritize remediation for internet-exposed SSH services.
- Reduce SSH exposure using VPNs, bastions, or allowlisted management networks.
- Monitor sshd memory use, failed handshakes, and connection spikes.
- Confirm Red Hat systems against Red Hat’s unaffected status before taking emergency action.
Validation and detection
- Inventory OpenSSH versions and package build sources across servers.
- Compare each platform against vendor advisories for CVE-2025-26466.
- Identify externally reachable SSH services and management interfaces.
- Review monitoring for abnormal sshd memory growth or connection churn.
- Document any vendor status that is unknown or not yet assessed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-26466 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6redhatVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2025-26466CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2345043CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://seclists.org/oss-sec/2025/q1/144CVE reference, redhat
- https://www.qualys.com/2025/02/18/openssh-mitm-dos.txtCVE reference, redhat
- https://security.netapp.com/advisory/ntap-20250228-0002/CVE reference, CVE
- https://www.openwall.com/lists/oss-security/2025/02/18/1CVE reference, CVE
- https://www.openwall.com/lists/oss-security/2025/02/18/4CVE reference, CVE
- https://bugzilla.suse.com/show_bug.cgi?id=1237041CVE reference, CVE
- https://security-tracker.debian.org/tracker/CVE-2025-26466CVE reference, CVE
- https://ubuntu.com/security/CVE-2025-26466CVE reference, CVE
- https://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-opensshCVE reference, CVE
- https://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-opensshCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.