OpenSSH Vulnerabilities CVE-2025-26465 and CVE-2025-26466: Man-in-the-Middle and DoS Risks

A newly disclosed vulnerability in OpenSSH poses a serious security risk to SSH clients and servers, allowing attackers to execute man-in-the-middle (MitM) attacks and denial-of-service (DoS) exploits. These flaws, identified as CVE-2025-26465 and CVE-2025-26466, have been present in OpenSSH for years and were discovered by security researchers at Qualys.

System administrators and users are urged to update OpenSSH to version 9.9p2 to mitigate these threats. This article explains the nature of these vulnerabilities, how to check if your system is affected, and what mitigation steps you can take.

CVE-2025-26465: Man-in-the-Middle Attack via Host Key Verification

This vulnerability affects OpenSSH clients when the VerifyHostKeyDNS option is enabled. It allows an attacker to intercept SSH connections by spoofing the server identity. This can lead to session hijacking, data interception, and credential theft.

How Does the Attack Work?

When an OpenSSH client connects to a server, it verifies the server's identity using SSH host keys. The VerifyHostKeyDNS option allows clients to trust host keys obtained via DNS SSHFP records instead of manually confirming them. If an attacker gains control of the DNS responses (e.g., via DNS poisoning or BGP hijacking), they can trick the client into accepting a forged SSH key, allowing them to intercept and modify SSH traffic.

Although VerifyHostKeyDNS is disabled by default, it was enabled by default on FreeBSD systems between September 2013 and March 2023, increasing the risk for affected users.

How to Check if Your OpenSSH Client is Vulnerable

Run the following command to check if VerifyHostKeyDNS is enabled on your system:

        grep VerifyHostKeyDNS ~/.ssh/config /etc/ssh/ssh_config 2>/dev/null

If the output shows VerifyHostKeyDNS yes, your system is vulnerable.

You can also test your OpenSSH version:

        ssh -V

If your version falls within 6.8p1 to 9.9p1, you should update OpenSSH immediately.

How to Disable VerifyHostKeyDNS

To mitigate the risk, disable VerifyHostKeyDNS by adding the following line to your SSH client configuration:

        echo "VerifyHostKeyDNS no" >> ~/.ssh/config

For system-wide settings, edit /etc/ssh/ssh_config and ensure the following is set:

        VerifyHostKeyDNS no

Restart the SSH service for changes to take effect:

        sudo systemctl restart ssh

CVE-2025-26466: Denial-of-Service (DoS) via SSH Handshake Manipulation

The second vulnerability, CVE-2025-26466, affects OpenSSH servers and allows attackers to launch a DoS attack by exploiting flaws in the SSH handshake process.

How Does the Attack Work?

The attacker sends an abnormally large number of SSH handshake messages, forcing the server to consume excessive memory and CPU resources. This eventually crashes the SSH service, preventing legitimate users from connecting.

The root cause lies in how OpenSSH processes SSH2_MSG_PING and SSH2_MSG_PONG responses. Since these messages are stored in memory before being processed, a high volume of them can exhaust system resources.

How to Check if Your OpenSSH Server is Vulnerable

To check your OpenSSH server version, run:

        sshd -V

If your server is running OpenSSH 9.5p1 to 9.9p1, it is vulnerable.

Additionally, review your SSH logs for high memory usage or repeated connection attempts from suspicious IPs:

        sudo journalctl -u sshd | grep "OOM"

If you see messages related to out-of-memory (OOM) errors, your system may already be under attack.

Mitigation Steps for SSH Servers

1. Upgrade OpenSSH to 9.9p2:

        sudo apt update && sudo apt upgrade openssh-server -y

1. Limit SSH Connection Attempts: Set MaxStartups in /etc/ssh/sshd_config to prevent excessive SSH handshake requests:

        echo "MaxStartups 10:30:60" >> /etc/ssh/sshd_config sudo systemctl restart ssh

1. Reduce Login Grace Time: Lowering LoginGraceTime reduces the window for potential abuse:

        echo "LoginGraceTime 20s" >> /etc/ssh/sshd_config sudo systemctl restart ssh

1. Implement Firewall Rules: Block repeated SSH connection attempts using iptables:

        sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

For systems using ufw, apply rate-limiting:

        sudo ufw limit OpenSSH

How BaseFortify Helps Protect Against These Vulnerabilities

For organizations seeking enhanced security monitoring, BaseFortify.eu provides an advanced cybersecurity platform that:

• Scans and identifies vulnerable OpenSSH versions in system environments.
• Alerts administrators to configuration risks, such as VerifyHostKeyDNS being enabled.
• Provides automated patching recommendations for known vulnerabilities.
• Leverages AI-driven insights to monitor for man-in-the-middle attempts and unusual SSH traffic.

By integrating real-time threat intelligence, BaseFortify ensures that businesses remain one step ahead of cyber threats.

Summary of Recommended Actions

For more details, visit:
🔗 BaseFortify OpenSSH CVE Report

🔗 Security.nl

Here, you can access the Q&A section and consult the AI Assistant for further guidance on mitigating OpenSSH vulnerabilities. The latter functionality does require you to register, which is for free at https://basefortify.eu/register