A corrective release of OpenSSH 9.9p2 is available, which addresses two vulnerabilities identified by Qualys. An example has been demonstrated using these vulnerabilities for a MITM attack, allowing the traffic from a client connecting to the SSH server to be redirected to a malicious fake server, bypassing host key verification and creating the illusion for the client that it is connected to the desired server (the SSH client will accept the host key from the fake server instead of the legitimate server's key). <\/p>\n
The first vulnerability (CVE-2025-26465) is caused by a logical error in the ssh utility, allowing for the bypassing of server authentication and carrying out a MITM attack. The issue manifests starting with release OpenSSH 6.8p1 (December 2014) in configurations where the VerifyHostKeyDNS setting is enabled. In the default OpenSSH installation, this option is turned off, but was enabled in the ssh settings on FreeBSD until March 2023. <\/p>\n
The essence of the problem is that in the code of the function verify_host_key_callback(), when the function verify_host_key() is called, only the error code '-1' is checked, while other codes, such as '-2', are ignored. As a result, the function verify_host_key_callback() may return a successful code '0' despite the error '-2' being returned by verify_host_key(). The error code '-2' is returned by the verify_host_key() function when there is insufficient memory. If conditions are created that make it impossible to allocate memory in the verify_host_key() function, SSH will consider the host key to have been successfully verified. To create such conditions, a spoofed SSH server from the attacker, to which the client is redirected, returns the host key of the maximum possible size (256KB), while simultaneously exploiting a memory leak on the ssh-client side. <\/p>\n
The conditions for creating the memory leak are achieved through the second vulnerability (CVE-2025-26466), which affects both the ssh client and the server. server<\/a> sshd, and exploited without authentication. The vulnerability allows exhausting available memory for the process and creating a high CPU load by sending a large number of SSH2_MSG_PING packets. There is a memory leak in the SSH2_MSG_PING packet handler that manifests starting from the release of OpenSSH 9.5p1 (August 2023). The leak occurs because a 256-byte buffer is allocated for each incoming 16-byte PING packet for response formation, but this buffer is only freed after key negotiation is completed. As a workaround for protection, it is recommended to set limits using the LoginGraceTime, MaxStartups, and PerSourcePenalties directives. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0436\u0435\u043b\u0430\u0435\u043c\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 (ssh-\u043a\u043b\u0438\u0435\u043d\u0442 \u043f\u0440\u0438\u043c\u0435\u0442 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u043c\u0435\u0441\u0442\u043e \u043a\u043b\u044e\u0447\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121998","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 9.9p2 update that eliminates the possibility of a MITM attack | ProHoster","description":"A corrective release of OpenSSH 9.9p2 is available, which fixes two vulnerabilities identified by Qualys.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 9.9p2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-18T18:22:04+00:00","article:modified_time":"2025-02-18T18:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121998","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:42:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:42:19","updated":"2026-01-23 10:42:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/121998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=121998"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/121998\/revisions"}],"predecessor-version":[{"id":173038,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/121998\/revisions\/173038"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=121998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=121998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=121998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"