Summary: OpenSSH has issued security updates in response to two significant vulnerabilities: a machine-in-the-middle (MitM) flaw introduced in 2014 and a pre-authentication denial of service (DoS) vulnerability introduced in 2023. Both vulnerabilities, discovered by Qualys, pose serious risks to users, particularly those who have enabled specific configurations. Users are urged to update to version 9.9p2 and to disable the ‘VerifyHostKeyDNS’ option unless absolutely necessary.
Affected: OpenSSH (Open Secure Shell)
Keypoints :
- The MitM vulnerability (CVE-2025-26465) allows attackers to bypass host verification by causing out-of-memory errors during SSH key verification.
- The DoS vulnerability (CVE-2025-26466) leads to excessive memory consumption from uncontrolled resource allocation during key exchange, potentially crashing systems.
- It is recommended to update to OpenSSH version 9.9p2, disable VerifyHostKeyDNS where possible, and implement strict connection rate limits.