OpenSSH Host Key Verification Vulnerability - CVE-2025-26465
Summary
CVE-2025-26465: A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Affects openssh across 5 version ranges.
>= 7de4b03a6e4071d454b72927ffaf52949fa34545, <= 6849957945754e6551e515f41e8cf3937cda222d
< 9.3_p2-r3
< 9f82e5a9042f2d872e98f48a876fcab3e25dd9bb
< 53a80baaebda180f46e6e8571f3ff800e1f5c496
< 485bab886137bbf8b7ec8df82bd66dc6e5654371
Fixed in 9.3_p2-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSH is a widely used suite of secure networking utilities based on the SSH protocol, providing encrypted communication over a computer network. It is essential for secure remote access and file transfers. The VerifyHostKeyDNS option enhances security by verifying host keys through DNS, but it is vulnerable to a machine-in-the-middle attack under certain conditions.
Vulnerability Detail
A vulnerability was discovered in OpenSSH when the VerifyHostKeyDNS option is enabled. This issue arises from the mishandling of error codes during host key verification, allowing a malicious actor to impersonate a legitimate server. The attack requires the attacker to exhaust the client's memory resources, making the complexity of the attack high. The potential ramifications include unauthorized access to sensitive data and disruption of secure communications.
How To Fix
Minimum fixed version
9.3_p2-r3
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the VerifyHostKeyDNS option in your OpenSSH configuration. This can be done by editing the ssh_config file and setting 'VerifyHostKeyDNS no'. However, this may reduce the security of your SSH connections.
Conclusion
CVE-2025-26465 represents a significant security risk for users of OpenSSH with the VerifyHostKeyDNS option enabled. It is crucial to update to the patched versions of OpenSSH to mitigate this vulnerability and ensure secure communications.
See every vulnerability recorded for openssh →
FAQ
CVE-2025-26465 is a vulnerability in OpenSSH that allows a machine-in-the-middle attack when the VerifyHostKeyDNS option is enabled.
If exploited, this vulnerability can allow attackers to impersonate legitimate servers, potentially leading to unauthorized access to sensitive information.
OpenSSH versions prior to 1:8.4p1-5+deb11u4 for Debian 11 and 1:9.2p1-2+deb12u5 for Debian 12 are affected. Debian 13 is also vulnerable but does not have a fixed version yet.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a monitoring tool that uses a manifest file like package-lock.json to alert users in real-time about open-source vulnerabilities in their software.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
