Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2025-26466-openssh-poc — CVE-2025-26466 OpenSSH SSH2_MSG_PING DoS PoC | Kitploit
Tools/GitHubGitHub/acidboonrs/cve-2025-26466-openssh-poc
Vulnerability AnalysisExploitationScripting & AutomationPenetration TestingLearning & Education
GitHubacidboonrs/cve-2025-26466-openssh-poc

cve-2025-26466-openssh-poc

CVE-2025-26466 OpenSSH SSH2_MSG_PING DoS PoC

View Repository
141 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-26466 OpenSSH SSH2_MSG_PING DoS PoC

Disclaimer: This code is intended exclusively for educational purposes and authorized security testing. Unauthorized attacks against third-party systems are illegal.

Vulnerability

CVE-2025-26466 is a pre-authentication denial-of-service (DoS) vulnerability in OpenSSH that allows an SSH server to be overwhelmed before the completion of the key exchange.

Technical Details

  • Affected: OpenSSH versions before 9.9p2
  • Type: Pre-Auth DoS / Memory Leak
  • Exploitation: SSH2_MSG_PING packets are processed before the encrypted connection is established

The server accepts SSH2_MSG_PING packets (Message Type 192) already during the initial handshake, without an authenticated connection existing. This leads to:

  • Memory leaks
  • CPU overload
  • Denial of Service

Installation

Requirements

  • Python 3.6+
  • Linux/macOS/Windows with Python3
root@kitploit:~
# Clone repository
git clone https://github.com/acidboonrs/cve-2025-26466-openssh-poc.git
cd cve-2025-26466-openssh-poc

# Make executable (optional)
chmod +x poc.py

No additional dependencies required (standard library only).

Usage

Basic Example

root@kitploit:~
python3 poc.py 192.168.1.10

With Custom Parameters

root@kitploit:~
python3 poc.py <target-host> [port] [threads] [pings]

Parameters:

  • <target-host> - Target IP or hostname (required)
  • [port] - SSH port (default: 22)
  • [threads] - Number of parallel connections (default: 10)
  • [pings] - PINGs per connection (default: 500)

Examples

root@kitploit:~
# Default: localhost, port 22, 10 threads, 500 PINGs
python3 poc.py localhost

# Increased load: 50 threads, 1000 PINGs
python3 poc.py 192.168.1.10 22 50 1000

# Custom port
python3 poc.py example.com 2222 20 800

How It Works

  1. TCP connection to the SSH server
  2. Exchange of SSH banners (client/server)
  3. SSH_MSG_KEXINIT (Key Exchange Initialization) is sent
  4. Critical point: Instead of waiting for the server response, SSH2_MSG_PING packets are buffered immediately
  5. Multi-threading enables parallel connections for higher load
  6. Server is put into an unstable state → DoS

Remediation

  • Upgrade to OpenSSH 9.9p2 or newer
  • Network filtering for SSH ports
  • Rate-limiting at the firewall level
  • Monitoring for abnormal SSH connection patterns

Further Information

  • CVE-2025-26466 Details
  • Blog Post (German)
  • OpenSSH Security Advisory

License

MIT License - see LICENSE for details

Responsible Disclosure

This PoC is published because:

  • CVE is publicly documented
  • Patches are available
  • Full vulnerability details are already public

Use this code only:

  • For educational purposes
  • On your own systems for testing
  • With explicit written permission from the system owner
  • In authorized security audits / penetration tests

Unauthorized DoS attacks are punishable by law!

Author: Vollassiliz (voidcall.dev)
Created: 2025-01-29

Download Tool