A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
2025-02-28T22:15:40.080
2025-05-27T16:15:31.100
Modified
CVSSv3.1: 5.9 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | openbsd | openssh | 9.5 | Yes |
| Application | openbsd | openssh | 9.6 | Yes |
| Application | openbsd | openssh | 9.6 | Yes |
| Application | openbsd | openssh | 9.7 | Yes |
| Application | openbsd | openssh | 9.7 | Yes |
| Application | openbsd | openssh | 9.8 | Yes |
| Application | openbsd | openssh | 9.8 | Yes |
| Application | openbsd | openssh | 9.9 | Yes |
| Application | openbsd | openssh | 9.9 | Yes |
| Operating System | canonical | ubuntu_linux | 24.04 | Yes |
| Operating System | canonical | ubuntu_linux | 24.10 | Yes |
| Operating System | debian | debian_linux | 11.0 | Yes |
| Operating System | debian | debian_linux | 12.0 | Yes |
| Operating System | debian | debian_linux | 13.0 | Yes |