OpenSSH Ping resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in OpenSSH. This issue affects some unknown processing of the component Ping Handler. The manipulation results in resource consumption. This vulnerability is cataloged as CVE-2025-26466. The attack may be launched remotely. There is no exploit available. Applying restrictive firewalling is recommended.

Detailsinfo

A vulnerability was found in OpenSSH (the affected version unknown). It has been classified as problematic. Affected is an unknown part of the component Ping Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

The advisory is shared for download at seclists.org. This vulnerability is traded as CVE-2025-26466 since 02/10/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/14/2025). The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 216422 (Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenSSH vulnerabilities (USN-7270-1)), which helps to determine the existence of the flaw in a target environment.

It is possible to mitigate the weakness by firewalling .

The vulnerability is also documented in the databases at Tenable (216422) and CERT Bund (WID-SEC-2025-0394). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• F5 BIG-IP
• SUSE Linux
• Xerox FreeFlow Print Server
• Oracle Linux
• NetApp FAS
• Gentoo Linux
• NetApp AFF
• NetApp ActiveIQ Unified Manager
• Siemens SIMATIC S7
• SUSE openSUSE
• RESF Rocky Linux
• OpenBSD OpenBSD
• Dell NetWorker
• Dell PowerScale
• Dell Avamar
• NetApp Data ONTAP
• Open Source OpenSSH
• Securepoint UTM
• Dell integrated Dell Remote Access Controller
• Fortinet FortiAnalyzer
• Fortinet FortiManager
• QNAP NAS
• WatchGuard Firebox
• HPE HP-UX
• Dell PowerProtect Data Domain

Productinfo

Type

• Connectivity Software

Name

• OpenSSH

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion