CVE-2025-26466

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVSS 3.1

5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

39% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2025-02-28

Modified

2026-10-21

Record from

the NVD, synced 2026-10-22

Affected

• canonical:ubuntu_linux
• debian:debian_linux
• openbsd:openssh

References

• https://access.redhat.com/errata/RHBA-2025:6305
• https://access.redhat.com/errata/RHSA-2025:6993
• https://access.redhat.com/security/cve/CVE-2025-26466
• https://bugzilla.redhat.com/show_bug.cgi?id=2345043
• https://seclists.org/oss-sec/2025/q1/144

Check your stackJSON