CVE-2013-6890

denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which...

5.0 MediumPublic exploitFix available

denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.

Exploit likelihood

8.90%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2013-6890
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6890
Updated: 2026-11-02

EUVDEUVD-2013-6692 No score

Record: EUVD-2013-6692
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f4g4-953x-f5pm No score

denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which...

Record: GHSA-f4g4-953x-f5pm
Weakness: CWE-287
Updated: 2026-11-02

OSVMGASA-2014-0080 No score

Updated denyhosts package fixes security vulnerability

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute force attacks in authentication logs could be exploited by a malicious user to forge crafted login names in order to make denyhosts ban arbitrary IP addresses (CVE-2013-6890).

This update also includes a fix for a regression introduced when fixing CVE-2013-6890.

Record: MGASA-2014-0080
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`denyhosts` Debian:6.0	before 2.6-7+deb6u2, plus listed versions 2.6-7	2.6-7+deb6u2
`denyhosts` Debian:7	before 2.6-10+deb7u2, plus listed versions 2.6-102.6-10+deb7u1	2.6-10+deb7u2
`denyhosts` Mageia:3	before 2.6-4.4.mga3	2.6-4.4.mga3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	DenyHosts - 'regex.py' Remote Denial of Service	2013-12-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6890 is a medium vulnerability (CVSS 5.0) in Phil Schwartz Denyhosts, published December 22, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.90%, the 95th percentile. Fixed in denyhosts 2.6-7+deb6u2.