OpenSSH fixes MITM and pre-authentication DoS flaws in CVE-2025-26465 and CVE-2025-26466

OpenSSH released security updates to address two vulnerabilities tracked as CVE-2025-26465 and CVE-2025-26466, with downstream advisories warning that affected deployments could face both server impersonation and service disruption. According to vendor and researcher disclosures, CVE-2025-26465 can enable a man-in-the-middle attack when VerifyHostKeyDNS is enabled, allowing an attacker to bypass host verification, present a crafted key, impersonate a trusted SSH server, and potentially intercept sessions, access sensitive data, or execute commands.

The second issue, CVE-2025-26466, is a pre-authentication denial-of-service flaw caused by unbounded memory allocation triggered through SSH2_MSG_PING messages, which can exhaust memory and disrupt SSH availability. Guidance from OpenSSH and national CSIRT reporting urges organizations to upgrade to OpenSSH 9.9p2 or later, disable VerifyHostKeyDNS unless it is strictly required, and harden exposed services with connection controls such as LoginGraceTime, MaxStartups, and PerSourcePenalties to reduce exploitation risk.