Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-26466

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVSS 5.9 · MediumBuzz score 25.9

Buzz score

Why this CVE is surfacing

Buzz score total 25.9

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 17.9 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
17.9
5 evidence mentions in the snapshot
Diversity score
8.0
3 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
5 source links · newest first
  • Two Vulnerabilities Patched in Ivanti Neurons for ITSMSecurityWeek

    The flaws could allow a remote attacker to maintain access after their account has been disabled and to access information from other user sessions.

    newswww.securityweek.comApr 15, 2026, 11:38 AM
  • Security Affairs newsletter Round 512 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Lazarus APT stole $1.5B from Bybit, it is the largest cryptocurrency heist ever Apple removes iCloud encryption in […]

    newssecurityaffairs.comFeb 23, 2025, 12:38 PM
  • OpenSSH Patches Vulnerabilities Allowing MitM, DoS AttacksSecurityWeek

    The latest OpenSSH update patches two vulnerabilities, including one that enabled MitM attacks with no user interaction.

    newswww.securityweek.comFeb 19, 2025, 1:32 PM
  • OpenSSH bugs allows Man-in-the-Middle and DoS AttacksSecurity Affairs

    Two OpenSSH vulnerabilities could allow machine-in-the-middle (MitM) and denial-of-service (DoS) attacks under certain conditions. The Qualys Threat Research Unit (TRU) has discovered two vulnerabilities in OpenSSH. The first, tracked as CVE-2025-26465 (CVSS score: 6.8) can be exploited by an attacker to conduct an active machine-in-the-middle attack on the OpenSSH client when the VerifyHostKeyDNS option is enabled. The […]

    newssecurityaffairs.comFeb 19, 2025, 12:10 PM
  • OpenSSH fixes flaws that enable man-in-the-middle, DoS attacksCSO Online

    OpenSSH, the most widely used tool for remotely managing Linux and BSD systems, received patches for two vulnerabilities. One of the flaws could allow attackers to perform a man-in-the-middle attack against OpenSSH clients with a certain configuration and impersonate a server to intercept sensitive communications. While the second vulnerability can lead to CPU resource exhaustion. […]

    newswww.csoonline.comFeb 18, 2025, 10:59 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence