Loading vulnerability…
CVE-2025-26466 is an OpenSSH client and server denial-of-service vulnerability in handling SSH2_MSG_PING messages during SSH key exchange. For each received ping, the affected peer allocates a pong response and queues it until key exchange completes. A malicious peer can repeatedly send ping messages while preventing completion of key exchange, causing queued responses to accumulate without an effective bound. This produces uncontrolled memory consumption; affected implementations may also incur CPU resource exhaustion while processing the messages.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository is a small standalone Python proof-of-concept exploit for CVE-2025-26466, a pre-authentication denial-of-service issue affecting OpenSSH versions before 9.9p2. The repository contains four files: a Python exploit script (poc.py), a README with usage and vulnerability background, a LICENSE, and a standard .gitignore. The only code file and clear entry point is poc.py. The exploit is not part of a larger framework. Its structure is straightforward: the SSHPingDoS class handles socket creation, SSH banner exchange, SSH packet construction, sending SSH_MSG_KEXINIT, and then flooding the target with repeated SSH2_MSG_PING packets. The helper function single_attack() performs one connection lifecycle, while multi_threaded_attack() launches multiple concurrent threads to amplify load against the target. The main block parses command-line arguments for hostname, port, thread count, and ping count. Operationally, the exploit connects to a user-supplied SSH host over TCP (default port 22), receives the server banner, sends a hardcoded client banner of SSH-2.0-OpenSSH_9.4p1, sends a minimally constructed SSH_MSG_KEXINIT packet, and immediately begins transmitting many SSH2_MSG_PING packets before authentication or full key exchange completion. This is intended to exploit vulnerable server behavior in handling message type 192 during the handshake, causing resource exhaustion and denial of service. The payload is basic but functional, making this an operational PoC rather than a detection script or fake exploit.
This repository contains a Metasploit auxiliary module (ping_dos.rb) that exploits CVE-2025-26466, a denial-of-service vulnerability in OpenSSH versions 9.5p1 to 9.9p1. The exploit works by sending a large number of SSH2_MSG_PING packets (type 192) to the target SSH server before authentication, which can exhaust the server's memory and CPU resources, potentially causing a lockup. The module allows configuration of the number of packets to send and optionally checks for a server response (SSH2_MSG_PONG). The README provides usage instructions for integrating the module into Metasploit and references to the CVE and related advisories. The main attack vector is network-based, targeting the SSH service (default port 22) on vulnerable OpenSSH servers. No hardcoded IPs or domains are present; the target is specified by the user at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A known SSH/OpenSSH vulnerability present on the operator's server, mentioned as part of the host's unpatched exposure.
DoS в OpenSSH из-за неограниченного выделения памяти во время key exchange, позволяющее удаленно вызвать отказ в обслуживании.
An OpenSSH vulnerability affecting both client and server that enables a pre-authentication denial-of-service attack.
A denial-of-service vulnerability in OpenSSH caused by unbounded memory allocation before authentication, allowing resource exhaustion via crafted SSH packets such as SSH2_MSG_PING.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.