OpenSSH Patches Two Critical Vulnerabilities, One Undetected for a Decade

Overview

OpenSSH has released security updates to fix two vulnerabilities: a man-in-the-middle (MitM) flaw and a denial-of-service (DoS) issue. Notably, one of these vulnerabilities has remained undiscovered for over a decade.

OpenSSH has released security updates addressing two newly discovered vulnerabilities:

• CVE-2025-26465 – A Man-in-the-Middle (MitM) attack flaw affecting OpenSSH clients.
• CVE-2025-26466 – A Denial of Service (DoS) vulnerability that can crash OpenSSH servers.

The MitM vulnerability was introduced over a decade ago, in OpenSSH 6.8p1 (December 2014), while the DoS flaw was introduced more recently in OpenSSH 9.5p1 (August 2023).

Both issues were discovered and demonstrated by Qualys researchers, who confirmed their exploitability to OpenSSH maintainers.

Details of the Vulnerabilities

CVE-2025-26465 – Man-in-the-Middle (MitM) Attack

This vulnerability affects OpenSSH clients when the VerifyHostKeyDNS option is enabled.

• Attackers can intercept SSH connections and present a rogue server’s key.
• By exploiting an out-of-memory error, they can bypass host verification and hijack the session.
• Once hijacked, attackers can steal credentials, inject commands, and exfiltrate data.

While VerifyHostKeyDNS is disabled by default, it was enabled by default in FreeBSD from 2013 to 2023, potentially exposing many systems to attacks.