Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

OpenSSH may connect to a fake server

published 1 year ago
Summary

When the VerifyHostKeyDNS setting is turned on in Azure OpenSSH, an attacker could impersonate a legitimate server and intercept connections. The attack requires the attacker to first fill the client’s memory, making it difficult but possible. To reduce risk, disable VerifyHostKeyDNS or upgrade to a version where the issue is fixed.

What to do
  • Update azure openssh to version 9.8p1-3.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure openssh < 9.8p1-3
Fix: upgrade to 9.8p1-3
Original advisory text
CVE-2025-26465 affecting package openssh for versions less than 9.8p1-3
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.8 Medium
Timeline
Published18 Feb 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-56894 · OSV
Track software like this
Free during beta