5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-26466

CVE-2025-26466: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong...

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-26466

CVE-2025-26466:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-26466) is a denial-of-service caused by uncontrolled memory consumption due to handling of SSH2_MSG_PING packets. The Qualys security advisory explicitly states this was introduced by commit dce6d80, which added the transport-level ping facility. The commit dce6d80 modifies the function ssh_packet_read_poll_seqnr in packet.c to process SSH2_MSG_PING. This function reads the PING data, creates a PONG packet, and then calls sshpkt_send(ssh). The vulnerability manifests because, as detailed in the advisory, during a key exchange, sshpkt_send (which calls ssh_packet_send2) queues these PONG packets. Each queued packet involves a new memory allocation (specifically, ssh_packet_send2 calls sshbuf_new()) that isn't freed until the key exchange is complete. This allows an attacker to send many PING packets, leading to excessive memory allocation for the queued PONGs, resulting in a DoS. Therefore, ssh_packet_read_poll_seqnr is identified as the vulnerable function because its modification in commit dce6d80 introduced the processing of PINGs that triggers this memory exhaustion behavior in conjunction with the existing packet queuing mechanism in ssh_packet_send2.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.