FreeSenseFreeSenseSecurity
freesense.org
← Fixed vulnerabilities
Fixed

Multiple vulnerabilities in OpenSSH

FreeBSD-SA-25:05.openssh · CVE-2025-26465, CVE-2025-26466

Our decision for FreeSense

FreeBSD corrected this on 2025-02-19, before the FreeBSD source pin of every FreeSense version.

  • Advisory: corrected 2025-02-19
  • FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
  • FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
  • FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
Decided by rules, not yet reviewed. The status comes from the advisory's correction date and the build configuration. A maintainer has not looked at whether FreeSense is exposed in practice. How we triage

By FreeSense version

VersionStatusFreeBSD pin
FreeSense 1.01.0.7 · frozen, no further fixesFixedFreeBSD pin of 2026-08-032026-08-03e004ff15
FreeSense 1.11.1.9FixedFreeBSD pin of 2026-10-042026-10-04a52c50b4
FreeSense 1.21.2.0-DEVELOPMENTFixedFreeBSD pin of 2026-10-042026-10-04a52c50b4

Workaround

* OpenSSH client host verification error (CVE-2025-26465) Disable the VerifyHostKeyDNS configuration directive in the ssh(1) configuration and rely on trust-on-first-use host keys or SSH certificate based host keys. See ssh_config(5). * OpenSSH server denial of service (CVE-2025-26466) No workaround is available, but this condition may be mitigated in the server by using the LoginGraceTime and MaxStartups server configuration directives. See sshd_config(5).

What FreeBSD says

* OpenSSH client host verification error (CVE-2025-26465) ssh(1) contains a logic error that allows an on-path attacker to impersonate any server during certain conditions when the VerifyHostKeyDNS option is enabled. * OpenSSH server denial of service (CVE-2025-26466) The OpenSSH client and server are both vulnerable to a memory/CPU denial of service while handling SSH2_MSG_PING packets.

Impact

* OpenSSH client host verification error (CVE-2025-26465) Under specific circumstances, a machine-in-the-middle may impersonate any server when the client has the VerifyHostKeyDNS option enabled. * OpenSSH server denial of service (CVE-2025-26466) During the processing of SSH2_MSG_PING packets, a server may be subject to a memory/CPU denial of service.

Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.

Copied to clipboard