CVE-2025-26465— Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-26465
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
未有动作错误条件的检测
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenSSH 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSSH（OpenBSD Secure Shell）是加拿大OpenBSD计划组的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现，支持对所有的传输进行加密，可有效阻止窃听、连接劫持以及其他网络级的攻击。 OpenSSH存在安全漏洞，该漏洞源于在VerifyHostKeyDNS选项启用时存在错误代码处理不当，会导致中间人攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | 0:8.0p1-26.el8_10 ~ * | cpe:/a:redhat:enterprise_linux:8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8 | 0:8.0p1-26.el8_10 ~ * | cpe:/a:redhat:enterprise_linux:8::appstream | |
| Red Hat | Red Hat Enterprise Linux 9 | 0:8.7p1-45.el9 ~ * | cpe:/o:redhat:enterprise_linux:9::baseos | |
| Red Hat | Red Hat Enterprise Linux 9 | 0:8.7p1-45.el9 ~ * | cpe:/o:redhat:enterprise_linux:9::baseos | |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | 0:8.7p1-38.el9_4.5 ~ * | cpe:/o:redhat:rhel_eus:9.4::baseos | |
| Red Hat | Red Hat Discovery 1.14 | sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63 ~ * | cpe:/a:redhat:discovery:1.14::el9 | |
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat Enterprise Linux 7 | - | cpe:/o:redhat:enterprise_linux:7 | |
| Red Hat | Red Hat OpenShift Container Platform 4 | - | cpe:/a:redhat:openshift:4 |
II. Public POCs for CVE-2025-26465
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | MitM attack allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to it | https://github.com/rxerium/CVE-2025-26465 | POC Details |
| 2 | Patch Manual para a correção das CVE-2025-26465-e-CVE-2025-26466, para sistemas sem update do OpenSSH | https://github.com/dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-26465
请登录查看更多情报信息。
- 2344780 – (CVE-2025-26465) CVE-2025-26465 openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabledissue-trackingx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2025-26465
IV. Related Vulnerabilities
Same weakness: CWE-390
- CVE-2025-0029
AMD EPYC 9005 Series 安全漏洞 - CVE-2025-46367
Dell Alienware Command Center 安全漏洞 - CVE-2025-27039
Detection of Error Condition Without Action in Computer Visi - CVE-2024-49841
Detection of Error Condition Without Action in Hypervisor - CVE-2025-25204
`gh attestation verify` returns incorrect exit code during v
V. Comments for CVE-2025-26465
No comments yet