Home > Vulnerability Database > CVE-2025-26465

Mend.io Vulnerability Database

CVE-2025-26465

Date: February 18, 2025

In OpenSSH versions 6.8p1 to 9.9p1, a logic error in ssh(1) allowed an on-path attacker to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is disabled by default.

Severity Score

6.8

Related Resources (26)

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-26465

Url: https://access.redhat.com/security/cve/CVE-2025-26465

Url: https://security.netapp.com/advisory/ntap-20250228-0003/

Url: https://access.redhat.com/errata/RHSA-2025:3837

Url: https://ubuntu.com/security/CVE-2025-26465

Url: https://access.redhat.com/errata/RHSA-2025:6993

Url: https://www.openwall.com/lists/oss-security/2025/02/18/1

Url: https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh

Url: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466

Url: https://access.redhat.com/solutions/7109879

Url: https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html

Url: https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/

Url: https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html

Url: https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig

Url: https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh

Url: https://www.openssh.com/releasenotes.html#9.9p2

Url: https://access.redhat.com/errata/RHSA-2025:16823

Url: https://access.redhat.com/errata/RHSA-2025:8385

Url: https://bugzilla.redhat.com/show_bug.cgi?id=2344780

Url: https://www.openssh.com/security.html

Url: https://www.openwall.com/lists/oss-security/2025/02/18/4

Url: https://bugzilla.suse.com/show_bug.cgi?id=1237040

Url: https://security.alpinelinux.org/vuln/CVE-2025-26465

Url: https://seclists.org/oss-sec/2025/q1/144

Url: https://security-tracker.debian.org/tracker/CVE-2025-26465

Url: https://www.mend.io/vulnerability-database/CVE-2025-26465

Severity Score

6.8

Weakness Type (CWE)

Channel Accessible by Non-Endpoint

CWE-300

Detection of Error Condition Without Action

CWE-390

CVSS v3.1

Base Score:	6.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2025-26465

Date: February 18, 2025

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?