Loading vulnerability…
OpenSSH Pre-Authentication Resource Exhaustion via SSH Ping Packets
CVE-2025-26466 is a pre-authentication denial-of-service vulnerability in OpenSSH client and server handling of SSH2_MSG_PING packets. During key exchange, each received ping causes a pong response to be allocated and queued in memory until key exchange completes. A malicious peer can repeatedly send ping packets, causing unbounded response accumulation and excessive memory and CPU consumption. Exploitation can exhaust resources and make the affected SSH service unavailable.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust memory and CPU resources, disrupting SSH availability and potentially affecting other workloads sharing the host. The vulnerability has a high availability impact; no confidentiality or integrity impact is identified. It does not itself provide code execution, authentication bypass, or privilege escalation.
If you can’t patch tonight, do this now.
Restrict SSH access to trusted administrative networks or VPN users and apply connection-rate limits and per-source throttling. Configure LoginGraceTime and MaxStartups to constrain unauthenticated connection duration and concurrency; use PerSourcePenalties where supported. These measures reduce server-side exposure but are not a complete workaround. Monitor SSH process memory and CPU usage for resource-exhaustion attempts.
Patch, then assume compromise.
Upgrade OpenSSH to version 9.9p2 or later, or install a distribution or appliance-vendor update explicitly fixing CVE-2025-26466. For FreeBSD, apply the official binary or source update and restart sshd. Dell iDRAC9 fixes are available in versions 7.00.00.181 and 7.20.30.50 or later within the applicable platform release track. Google Container-Optimized OS fixes include builds 17412.535.78 and 17800.436.60 or later in their respective release tracks. Confirm the appropriate fixed build with the product vendor rather than relying solely on the upstream OpenSSH version number.
2 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
22 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.