CVE-2025-26466: canonical ubuntu_linux

Vulnerability summary

CVE-2025-26466 is a medium (CVSS 5.9) vulnerability in canonical ubuntu_linux. EPSS estimates a 40.65% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities.

Timeline

1. 28-02-2025
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.