CVE-2025-26466

Publication date 18 February 2025

Last updated 5 March 2025

Ubuntu priority

Cvss 3 Severity Score

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssh	24.10 oracular	Fixed 1:9.7p1-7ubuntu4.2
	24.04 LTS noble	Fixed 1:9.6p1-3ubuntu13.8
	22.04 LTS jammy FIPS Updates	Not affected
	20.04 LTS focal FIPS Updates	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
openssh-ssh1	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected

Notes

mdeslaur

openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only. introduced in 9.5p1

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssh	Upstream: 6ce00f0

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H