OpenSSH VerifyHostKeyDNS cryptographic issue

Summaryinfo

A vulnerability identified as problematic has been detected in OpenSSH. This vulnerability affects unknown code of the component VerifyHostKeyDNS Handler. The manipulation leads to cryptographic issue. This vulnerability is listed as CVE-2025-26465. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in OpenSSH (affected version not known) and classified as problematic. This issue affects some unknown functionality of the component VerifyHostKeyDNS Handler. The manipulation with an unknown input leads to a cryptographic issue vulnerability. Using CWE to declare the problem leads to CWE-310. Impacted is confidentiality. The summary by CVE is:

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

It is possible to read the advisory at seclists.org. The identification of this vulnerability is CVE-2025-26465 since 02/10/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/23/2025). The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 216407 (Debian dsa-5868 : openssh-client - security update), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (216407), EUVD (EUVD-2025-4686) and CERT Bund (WID-SEC-2025-0394). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• F5 BIG-IP
• SUSE Linux
• Xerox FreeFlow Print Server
• Oracle Linux
• NetApp FAS
• Gentoo Linux
• NetApp AFF
• NetApp ActiveIQ Unified Manager
• Siemens SIMATIC S7
• SUSE openSUSE
• RESF Rocky Linux
• OpenBSD OpenBSD
• Dell NetWorker
• Dell PowerScale
• Dell Avamar
• NetApp Data ONTAP
• Open Source OpenSSH
• Securepoint UTM
• Dell integrated Dell Remote Access Controller
• Fortinet FortiAnalyzer
• Fortinet FortiManager
• QNAP NAS
• WatchGuard Firebox
• HPE HP-UX
• Dell PowerProtect Data Domain

Productinfo

Type

• Connectivity Software

Name

• OpenSSH

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion