CVE-2023-25136
MediumPublic exploitOpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.
Published Feb 3, 2023 · Updated Oct 16, 2026 · Also known as DEBIAN-CVE-2023-25136, JLSEC-2026-66, UBUNTU-CVE-2023-25136
Key Facts
Patch immediately- CVE-2023-25136 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting Ontap Select Deploy Administration Utility (Netapp), Openssh (Openbsd), Fedora (Fedoraproject) and 10 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 90% probability of exploitation in the next 30 days.
- Fixed versions are available, including Openssh 0:8.7p1-29.el9_2, Openssh 1:9.2p1-1, Openssh 8.7p1-29.el9_2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS (30-day exploit likelihood)
90%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2023-25136 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Affected Products
31 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Ontap Select Deploy Administration UtilityNetapp | See advisory | n/a |
| OpensshOpenbsd | 9.1 | 9.2p1-1 |
| FedoraFedoraproject | 37, 38 | n/a |
| 500f FirmwareNetapp | See advisory | n/a |
| A250 FirmwareNetapp | See advisory | n/a |
Patched Releases
Openssh
0:8.7p1-29.el9_2, 1:9.2p1-1, 8.7p1-29.el9_2, 9.2_p1-r0, 9.2p1-1
OpenSSH_jll
9.1.0+0
openssh-askpass
8.7p1-29.el9_2
openssh-clients
8.7p1-29.el9_2
openssh-keycat
8.7p1-29.el9_2
openssh-server
8.7p1-29.el9_2
pam_ssh_agent_auth
0.10.4-5.29.el9_2
rootio-openssh
1:9.2p1-1
Timeline
Publicly disclosed
Feb 3, 2023
Last updated
Oct 16, 2026
Weakness Type
- CWE-401 Missing Release of Memory after Effective Lifetime
- CWE-415 Double Free
References
- advisoryRHSA-2023:2645
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25136.json
- advisoryhttps://news.ycombinator.com/item?id=34711565
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-25136
- advisoryGLSA-202307-01
FAQ
Common Questions.
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.
Affected: Ontap Select Deploy Administration Utility (Netapp); Openssh (Openbsd) versions 9.1; Fedora (Fedoraproject) versions 37, 38, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Openssh 0:8.7p1-29.el9_2, Openssh 1:9.2p1-1, Openssh 8.7p1-29.el9_2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-25136 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo