CVE-2025-26466
MediumCVSS 5.9Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.
Risk Assessment
The risk is a denial of service (DoS) attack that exhausts server memory, potentially making the SSH server unavailable and disrupting critical organizational services.
Recommendation
Apply security patches from the OpenSSH distributor immediately, and limit concurrent connections and ping packets via server configuration or firewall.
Original NVD description (English source)
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.