Moderate Security Update: OpenSSH Vulnerability in AlmaLinux 8
Summary
ALSA-2025:16823: Moderate: openssh security update. Affects openssh versions < 8.0p1-26.el8_10. Fixed in 8.0p1-26.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, which provides secure communication over an unsecured network. It is essential for remote server management and secure file transfers. The package includes both client and server components, making it a critical tool for system administrators. The recent vulnerability affects OpenSSH's ability to verify host keys, potentially exposing users to machine-in-the-middle attacks.
Vulnerability Detail
The vulnerability identified as CVE-2025-26465 arises when the VerifyHostKeyDNS option is enabled in OpenSSH. This flaw allows an attacker to perform a machine-in-the-middle attack, potentially intercepting and altering communications between the client and server. The implications of this vulnerability are significant, as it undermines the core security guarantees provided by SSH, leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
8.0p1-26.el8_10
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the VerifyHostKeyDNS option in their SSH configuration file (typically located at /etc/ssh/ssh_config or ~/.ssh/config) by adding the following line: 'VerifyHostKeyDNS no'. However, this is not a permanent solution and should only be used until the package can be updated.
Conclusion
In summary, the OpenSSH vulnerability identified as CVE-2025-26465 poses a significant risk to users of AlmaLinux 8. It is crucial to update to the patched version to ensure the security of your systems. Temporary workarounds are available, but they do not replace the need for an update.
See every vulnerability recorded for openssh →
FAQ
CVE-2025-26465 is a vulnerability in OpenSSH that allows for machine-in-the-middle attacks when the VerifyHostKeyDNS option is enabled.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by this vulnerability.
Failing to update OpenSSH exposes your system to potential unauthorized access and data breaches due to the vulnerability that allows attackers to intercept communications.
While the best solution is to update, you can temporarily disable the VerifyHostKeyDNS option in your SSH configuration as a workaround.
For more details, refer to the CVE page associated with CVE-2025-26465, which provides comprehensive information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
