CVE-2025-26466

Summary

CVE-2025-26466 is a denial-of-service vulnerability affecting the OpenSSH package. The issue lies in the handling of ping packets in the SSH server. For each ping packet received, a pong packet is allocated in a memory buffer and added to a queue. These packets are not freed until the key exchange is completed. A malicious client can exploit this flaw by continuously sending ping packets, causing an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.