MiTM and DoS Attacks Enabled by Critical Flaws in OpenSSH

Introduction

OpenSSH has recently released security updates to address two critical vulnerabilities that expose SSH servers to machine-in-the-middle (MiTM) and denial-of-service (DoS) attacks. One of these vulnerabilities has remained undiscovered for over a decade. The security research team at Qualys identified and reported these issues to OpenSSH maintainers, demonstrating their potential exploitability.

OpenSSH (Open Secure Shell) is a widely used, open-source implementation of the SSH (Secure Shell) protocol. It provides encrypted communication for secure remote access, file transfers, and tunneling over untrusted networks. With high adoption across Linux and Unix-based systems, including BSD and macOS, OpenSSH is a fundamental component in enterprise environments, IT, DevOps, cloud computing, and cybersecurity applications. Given its ubiquity, vulnerabilities in OpenSSH present significant risks to global cybersecurity.

Overview of the Vulnerabilities

CVE-2025–26465: MiTM Vulnerability

This machine-in-the-middle (MiTM) vulnerability, tracked as CVE-2025–26465, was introduced in OpenSSH version 6.8p1, released in December 2014. The flaw affects OpenSSH clients when the VerifyHostKeyDNS option is enabled, allowing attackers to intercept SSH connections and inject malicious data.

According to Qualys, this vulnerability is particularly concerning because it allows for exploitation regardless of whether VerifyHostKeyDNS is set to yes or ask (the default is no). The attack does not require user interaction or the presence of an SSHFP resource record (an SSH fingerprint) in DNS.

The attack method involves tricking the SSH client into accepting a rogue server’s key by triggering an out-of-memory error during key verification. An attacker can achieve this by intercepting an SSH connection and presenting an excessively large SSH key with numerous certificate extensions. This forces the client into a resource exhaustion state, bypassing host verification and allowing the attacker to hijack the SSH session. Once compromised, the attacker can:

1. Steal login credentials
2. Inject arbitrary commands
3. Exfiltrate sensitive data

While VerifyHostKeyDNS is disabled by default in OpenSSH, it was enabled by default in FreeBSD from 2013 until 2023, leaving many systems vulnerable to this attack vector for years.

CVE-2025–26466: Pre-Authentication DoS Vulnerability

The second vulnerability, tracked as CVE-2025–26466, is a pre-authentication denial-of-service (DoS) flaw introduced in OpenSSH 9.5p1, released in August 2023. This issue arises from an unrestricted memory allocation during the SSH key exchange process, which an attacker can exploit to cause excessive resource consumption.

Specifically, an attacker can send multiple small 16-byte ping messages, which forces OpenSSH to buffer 256-byte responses indefinitely. This mechanism creates an uncontrollable memory consumption loop, leading to high CPU usage, potential system slowdowns, and eventual crashes.

Although the impact of CVE-2025–26466 is not as severe as the MiTM vulnerability, its ability to disrupt SSH servers before authentication makes it a high-risk flaw for denial-of-service attacks. Exploiting this flaw does not require credentials or previous access to the system, making it an attractive attack vector for malicious actors aiming to cause service outages.

Security Updates and Mitigation

In response to these vulnerabilities, the OpenSSH development team has released version 9.9p2, which addresses both security flaws. Administrators and users are strongly urged to update their OpenSSH installations as soon as possible to prevent potential exploitation.

Mitigation for CVE-2025–26465 (MiTM Attack)

To mitigate the risk of a machine-in-the-middle attack, users should:

Disable VerifyHostKeyDNS unless absolutely necessary.

Manually verify SSH key fingerprints before establishing connections.

Use strict host key policies to prevent untrusted key acceptance.

Enable SSH strict host key checking in configuration files.

Monitor SSH logs for unusual key verification behaviors.

Mitigation for CVE-2025–26466 (DoS Attack)

To prevent exploitation of the pre-authentication DoS vulnerability, administrators should:

Upgrade to OpenSSH 9.9p2 or later.

Enforce connection rate limits to prevent excessive SSH requests.

Monitor SSH traffic for abnormal patterns and resource consumption spikes.

Use firewall rules to restrict access to SSH services from untrusted networks.

Implement process and memory monitoring tools to detect unusual memory allocation trends.

Broader Implications of These Vulnerabilities

The discovery of CVE-2025–26465 and CVE-2025–26466 highlights the importance of continuous security audits and proactive vulnerability management in widely used software. The fact that CVE-2025–26465 remained undiscovered for over a decade underscores the potential risks of long-standing security flaws in critical infrastructure tools.

Furthermore, these vulnerabilities reinforce the increasing sophistication of cyber threats. Attackers constantly refine their techniques to exploit overlooked vulnerabilities, making regular updates and strict security configurations essential for organizations relying on OpenSSH.

Recommendations for Organizations

• Organizations and IT security teams should take the following steps to enhance their SSH security posture:
• Conduct a comprehensive security audit of SSH configurations and ensure best practices are followed.
• Apply security patches promptly to prevent exploitation of known vulnerabilities.
• Deploy multi-factor authentication (MFA) for SSH access to add an additional layer of security.
• Limit SSH access to trusted IP ranges and implement strict access control policies.
• Monitor system logs and alerts for SSH-related anomalies and unauthorized access attempts.
• Educate users and IT personnel about social engineering and SSH security risks.

Conclusion

The newly discovered OpenSSH vulnerabilities, CVE-2025–26465 and CVE-2025–26466, expose SSH servers to serious threats, including machine-in-the-middle attacks and pre-authentication denial-of-service exploits. These flaws emphasize the critical need for regular security updates, strict configuration policies, and proactive monitoring to safeguard against sophisticated cyberattacks.

Organizations and individuals relying on OpenSSH should immediately upgrade to version 9.9p2, disable unnecessary features that introduce security risks, and implement strong security measures to protect against future exploits. As cyber threats continue to evolve, staying ahead with timely security patches and best practices remains paramount in securing remote access infrastructure.