CVE-2025-61984: openbsd openssh

Vulnerability summary

CVE-2025-61984 is a low (CVSS 3.6) vulnerability in openbsd openssh. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-10-2025
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

• CWE-159Improper Handling of Invalid Use of Special ElementsThe product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.