CVE-2025-22869
Vulnerability Summary
Timeline
Description
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.92%• Percentile: 59%
Techniques & Countermeasures
- CWE-770•Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected Systems
- chainguard•aactl
< 0.4.12-r27
- chainguard•actions-runner-controller
< 0.10.1-r4
- chainguard•actions-runner-controller-compat
< 0.10.1-r4
- chainguard•actions-runner-controller-fips
< 0.10.1-r4
- chainguard•actions-runner-controller-fips-compat
< 0.10.1-r4
- chainguard•age
< 1.2.1-r3
- chainguard•age-fips
< 1.2.1-r3
- chainguard•agentbeat-fips
< 8.17.3-r1
- chainguard•amass
< 4.2.0-r20
- chainguard•amazon-cloudwatch-agent
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-all
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 1.300053.0-r7
- chainguard•amazon-cloudwatch-agent-compat
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-config-downloader
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 1.300053.0-r7
- chainguard•amazon-cloudwatch-agent-config-translator
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 1.300053.0-r7
- chainguard•amazon-cloudwatch-agent-fips
< 1.300053.0-r7
- chainguard•amazon-cloudwatch-agent-operator
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-operator-compat
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-operator-fips
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-operator-fips-compat
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 1.300053.0-r7
- chainguard•amazon-ssm-agent
< 3.3.1957.0-r5
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.1957.0-r5
- chainguard•apko
< 0.25.5-r0
- chainguard•argo-cd-2.11
< 2.11.13-r4
- chainguard•argo-cd-2.13
< 2.13.5-r6
- chainguard•argo-cd-2.13-compat
< 2.13.5-r6
- chainguard•argo-cd-2.13-repo-server
< 2.13.5-r6
- chainguard•argo-cd-2.14
< 2.14.7-r0
- chainguard•argo-cd-2.14-compat
< 2.14.7-r0
- chainguard•argo-cd-2.14-repo-server
< 2.14.7-r0
- chainguard•argo-cd-fips-2.14
< 2.14.5-r1
- chainguard•argo-cd-fips-2.14-compat
< 2.14.5-r1
- chainguard•argo-cd-fips-2.14-repo-server
< 2.14.5-r1
- chainguard•argo-events
< 1.9.5-r3
- chainguard•argo-events-fips
< 1.9.5-r4
- chainguard•argo-rollouts
< 1.8.0-r31
- chainguard•argo-rollouts-fips
< 1.8.0-r4
- chainguard•argo-workflows
< 3.6.5-r0
- chainguard•argo-workflows-fips
< 3.6.5-r2
- chainguard•argocd-image-updater
< 0.15.2-r8
- chainguard•argocd-image-updater-compat
< 0.15.2-r8
- chainguard•argocd-image-updater-fips
< 0.15.2-r7
- chainguard•atlantis
< 0.33.0-r2
- chainguard•atlantis-fips
< 0.33.0-r3
- chainguard•auditbeat-7
< 7.17.28-r5
Showing first 50 affected entries in server-rendered view.
References (41)
- https://go.dev/cl/652135
- https://go.dev/issue/71931
- https://pkg.go.dev/vuln/GO-2025-3487
- https://security.netapp.com/advisory/ntap-20250411-0010/
- https://nvd.nist.gov/vuln/detail/CVE-2025-22869
- https://github.com/golang/crypto/commit/7292932d45d55c7199324ab0027cc86e8198aa22
- https://github.com/golang/crypto
- https://go-review.googlesource.com/c/crypto/+/652135
- https://security.netapp.com/advisory/ntap-20250411-0010
- https://access.redhat.com/errata/RHSA-2025:3165
- https://access.redhat.com/security/updates/classification/#important
- https://bugzilla.redhat.com/show_bug.cgi?id=2348367
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3165.json
- https://access.redhat.com/security/cve/CVE-2025-22869
- https://www.cve.org/CVERecord?id=CVE-2025-22869
- https://access.redhat.com/errata/RHSA-2025:3175
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3175.json
- https://access.redhat.com/errata/RHSA-2025:3184
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3184.json
- https://access.redhat.com/errata/RHSA-2025:3185
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3185.json
- https://access.redhat.com/errata/RHSA-2025:3186
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3186.json
- https://access.redhat.com/errata/RHSA-2025:3210
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3210.json
- https://access.redhat.com/errata/RHSA-2025:3266
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3266.json
- https://access.redhat.com/errata/RHSA-2025:3268
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3268.json
- https://access.redhat.com/errata/RHSA-2025:3336
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3336.json
- https://access.redhat.com/errata/RHSA-2025:3685
- https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/release_notes/index
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3685.json
- https://access.redhat.com/errata/RHSA-2025:3833
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3833.json
- https://access.redhat.com/errata/RHSA-2025:7416
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7416.json
- https://access.redhat.com/errata/RHSA-2025:7484
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7484.json
- https://security-tracker.debian.org/tracker/CVE-2025-22869