Allocation of Resources Without Limits or Throttling Affecting openssh package, versions <1:9.7p1-7ubuntu4.2


Severity

Recommended
0.0
medium
0
10

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.05% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU2410-OPENSSH-8732290
  • published18 Feb 2025
  • disclosed28 Feb 2025

Introduced: 18 Feb 2025

CVE-2025-26466  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade Ubuntu:24.10 openssh to version 1:9.7p1-7ubuntu4.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.10 relevant fixed versions and status.

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVSS Base Scores

version 3.1