CVE-2025-26466: Canonical Ubuntu Linux

Medium severity, CVSS 5.9. EPSS: 40.7% chance of exploitation in the next 30 days.

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

Affected products

• Canonical Ubuntu Linux: version 24.04 only; version 24.10 only
• Debian Debian Linux: version 11.0 only; version 12.0 only; version 13.0 only
• OpenBSD OpenSSH: version 9.5 only; version 9.6 only; version 9.7 only; version 9.8 only; version 9.9 only

Published 2025-02-28. Last modified 2026-10-08.