CVE-2025-26466
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and sto
CVSS
5.9
Média
EPSS
38.7%
p99
KEV
—
Exploit Today
30
0-100
Publicado: 28 de fev. de 2025 · Última mod.: 5 de nov. de 2026 · CWE-770
38.7%EPSS · 30 dias40.6%
2026-10-112026-11-08
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
- access.redhat.comhttps://access.redhat.com/errata/RHBA-2025:6305
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2025:6993
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2025-26466
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2345043
- seclists.orghttps://seclists.org/oss-sec/2025/q1/144
- www.qualys.comhttps://www.qualys.com/2025/02/18/openssh-mitm-dos.txt
- seclists.orghttp://seclists.org/fulldisclosure/2025/Feb/18
- seclists.orghttp://seclists.org/fulldisclosure/2025/May/7
- seclists.orghttp://seclists.org/fulldisclosure/2025/May/8
- bugzilla.suse.comhttps://bugzilla.suse.com/show_bug.cgi?id=1237041
- security-tracker.debian.orghttps://security-tracker.debian.org/tracker/CVE-2025-26466
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20250228-0002/
- ubuntu.comhttps://ubuntu.com/security/CVE-2025-26466
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2025/02/18/1
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2025/02/18/4
- www.vicarius.iohttps://www.vicarius.io/vsociety/posts/cve-2025-26466-detection-script-memory-consumption-vulnerability-in-openssh
- www.vicarius.iohttps://www.vicarius.io/vsociety/posts/cve-2025-26466-mitigation-script-memory-consumption-vulnerability-in-openssh
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
- www.qualys.comhttps://www.qualys.com/2025/02/18/openssh-mitm-dos.txt
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1208547.5 ALT—
———Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.4hCVE-2026-123770——
———Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.6hCVE-2026-120367——
———Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.6hCVE-2026-116337——
———Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.8hCVE-2026-166976.5 MÉD—
——0IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources.21hCVE-2026-930056.5 MÉD—
——0IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.22h