Is CVE-2025-26465 in the CISA KEV catalog?

No. CVE-2025-26465 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2025-26465?

CVE-2025-26465 has a CVSS v3 base score of 6.8 (MEDIUM).

What is the EPSS score for CVE-2025-26465?

CVE-2025-26465 has an EPSS score of 7.00% (93th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2025-26465?

Upgrade openssh on debian 11 to 1:8.4p1-5+deb11u4 or later. Fixes are available for 42 affected products.

CVE & CISA-KEV Catalog

CVE-2025-26465

MEDIUMEPSS 93th pctl

6.8

CVSS v3

NVD

Description

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CWE-390

How to fix

Remediation Available

opensshDebian

Fixed in:1:8.4p1-5+deb11u4CVE-2025-26465

Fixed in:1:9.2p1-2+deb12u5CVE-2025-26465

Fixed in:1:9.9p2-1CVE-2025-26465

opensshRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

opensshRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-askpassRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-askpassRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-askpass-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-askpass-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-cavsRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-cavsRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-cavs-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-cavs-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-clientsRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-clientsRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-clients-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-clients-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debugsourceRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debugsourceRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-keycatRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-keycatRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-keycat-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-keycat-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-ldapRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-ldapRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-ldap-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-ldap-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-serverRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-serverRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-server-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-server-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-sk-dummy-debuginfoRocky

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-sk-dummy-debuginfoRed Hat / RHEL

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

pam_ssh_agent_authRed Hat / RHEL

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

pam_ssh_agent_authRocky

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

pam_ssh_agent_auth-debuginfoRed Hat / RHEL

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

pam_ssh_agent_auth-debuginfoRocky

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

registry.redhat.io/discovery/discoveryRocky

Fixed in:ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64RHSA-2025:8385

Fixed in:server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64RHSA-2025:8385

Fixed in:server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64RHSA-2025:8385

Fixed in:ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64RHSA-2025:8385

registry.redhat.io/discovery/discoveryRed Hat / RHEL

Fixed in:server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64RHSA-2025:8385

Fixed in:ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64RHSA-2025:8385

Fixed in:server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64RHSA-2025:8385

Fixed in:ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64RHSA-2025:8385

opensshUbuntu

Fixed in:1:7.2p2-4ubuntu2.10+esm7USN-7270-2

Fixed in:1:7.6p1-4ubuntu0.7+esm4USN-7270-2

Fixed in:1:8.2p1-4ubuntu0.12USN-7270-1

Fixed in:1:8.9p1-3ubuntu0.11USN-7270-1

Fixed in:1:9.6p1-3ubuntu13.8USN-7270-1

openssh-clientUbuntu

Fixed in:1:7.2p2-4ubuntu2.10+esm7USN-7270-2

Fixed in:1:7.6p1-4ubuntu0.7+esm4USN-7270-2

Fixed in:1:8.2p1-4ubuntu0.12USN-7270-1

Fixed in:1:8.9p1-3ubuntu0.11USN-7270-1

Fixed in:1:9.6p1-3ubuntu13.8USN-7270-1

openssh-serverUbuntu

Fixed in:1:7.2p2-4ubuntu2.10+esm7USN-7270-2

Fixed in:1:7.6p1-4ubuntu0.7+esm4USN-7270-2

Fixed in:1:8.2p1-4ubuntu0.12USN-7270-1

Fixed in:1:8.9p1-3ubuntu0.11USN-7270-1

Fixed in:1:9.6p1-3ubuntu13.8USN-7270-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploit Intelligence

7.00%probability of exploitation in 30 days

93rdpercentile

High risk: more likely to be exploited than 93% of all known CVEs.

References

Patch1

ftp.openbsd.org

Mitigation1

vicarius.io

Third-Party Advisory12

Issue Tracking1

bugzilla.suse.com

Release Notes1

openssh.com

Press / Media1

theregister.com

Other references9

Embed a live status badge for CVE-2025-26465

Markdown

[![CVE-2025-26465](https://tridentstack.com/cve/badge/CVE-2025-26465.svg)](https://tridentstack.com/cve/CVE-2025-26465)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-26465"><img src="https://tridentstack.com/cve/badge/CVE-2025-26465.svg" alt="CVE-2025-26465"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-05-12.