"The attack against the OpenSSH client (CVE-2025-26465) succeeds regardless of whether the VerifyHostKeyDNS option is set to "yes" or "ask" (its default is "no"), requires no user interaction, and does not depend on the existence of an SSHFP resource record (an SSH fingerprint) in DNS," explains Qualys. OpenSSH has released security updates addressing two vulnerabilities, a machine-in-the-middle (MitM) and a denial of service flaw, with one of the flaws introduced over a decade ago. The flaw affects OpenSSH clients when the 'VerifyHostKeyDNS' option is enabled, allowing threat actors to perform MitM attacks. Although the 'VerifyHostKeyDNS' option is disabled by default in OpenSSH, it was enabled by default on FreeBSD from 2013 until 2023, leaving many systems exposed to these attacks. OpenSSH (Open Secure Shell) is a free, open-source implementation of the SSH (Secure Shell) protocol, which provides encrypted communication for secure remote access, file transfers, and tunneling over untrusted networks. The second vulnerability is CVE-2025-26466, a pre-authentication denial of service flaw introduced in OpenSSH 9.5p1, released in August 2023. The MiTM vulnerability, tracked under CVE-2025-26465, was introduced in December 2014 with the release of OpenSSH 6.8p1, so the issue remained undetected for over a decade. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. An attacker can repeatedly send small 16-byte ping messages, which forces OpenSSH to buffer 256-byte responses without immediate limits. The OpenSSH team published version 9.9p2 earlier today, which addresses both vulnerabilities, so everyone is recommended to move to that release as soon as possible.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 18 Feb 2025 17:10:28 +0000