ZeroDay Findings
Sign inSign up

Findings

CVE-2023-25136

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.

Published Feb 3, 2023 · updated Oct 14, 2026 · openbsd openssh

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Timeline

Detection, updates, and resolution for this record.

  1. Feb 3, 2023 · NIST NVD

    Detected

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

  2. Oct 14, 2026 · NIST NVD

    Updated

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Affected

  • cpe fedoraproject/fedora37
  • cpe fedoraproject/fedora38
  • cpe netapp/500f firmwareversion unspecified
  • cpe netapp/a250 firmwareversion unspecified
  • cpe netapp/c250 firmwareversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe openbsd/openssh9.1

Sources

  • CVE.orgVulnerability recordCVE-2023-25136

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-25136

    30-day exploitation probability 89.7%

    first.org
  • NIST NVDVulnerability recordCVE-2023-25136

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address

    nvd.nist.gov

References