Every CVE Search/ Get API key

CVE-2023-25136

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms...

6.5 MediumPublic exploitFix available

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

89.8%Up 88.8 points since Feb 3, 2023
90%50%10%1%

What each source reports

NVD Score used 6.5

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
CVE-2023-25136
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
CVE-2023-25136
Weakness
CWE-415
Updated
2026-11-02
EUVDEUVD-2023-29115 No score

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
EUVD-2023-29115
Updated
2026-11-02
GitHub AdvisoriesGHSA-w62j-g234-3f6f 9.8

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms...

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting this vulnerability will not be easy."

Record
GHSA-w62j-g234-3f6f
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVBELL-CVE-2023-25136 6.5
Record
BELL-CVE-2023-25136
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-25136 6.5

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
DEBIAN-CVE-2023-25136
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVJLSEC-2026-66 6.5

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
JLSEC-2026-66
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVOESA-2023-1063 5.5

openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration. One third-party report states "remote code execution is theoretically possible."(CVE-2023-25136)

Record
OESA-2023-1063
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVOESA-2023-1064 5.5

openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration. One third-party report states "remote code execution is theoretically possible."(CVE-2023-25136)

Record
OESA-2023-1064
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:2645 6.5

Red Hat Security Advisory: openssh security update

Record
RHSA-2023:2645
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-25136 6.5

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
UBUNTU-CVE-2023-25136
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVALSA-2023:2645 No score

Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability (CVE-2023-25136)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2645
Updated
2026-11-02
OSV No score

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Record
CVE-2023-25136
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
AlmaLinux:9
 before 8.7p1-29.el9_2
8.7p1-29.el9_2
openssh-askpass
AlmaLinux:9
 before 8.7p1-29.el9_2
8.7p1-29.el9_2
openssh-clients
AlmaLinux:9
 before 8.7p1-29.el9_2
8.7p1-29.el9_2
openssh-keycat
AlmaLinux:9
 before 8.7p1-29.el9_2
8.7p1-29.el9_2
openssh-server
AlmaLinux:9
 before 8.7p1-29.el9_2
8.7p1-29.el9_2
pam_ssh_agent_auth
AlmaLinux:9
 before 0.10.4-5.29.el9_2
0.10.4-5.29.el9_2
openssh
Alpaquita:23
 9.1_p1-r3 up to 9.1_p1-r7
9.1_p1-r7
openssh
BellSoft Hardened Containers:23
 9.1_p1-r3 up to 9.1_p1-r7
9.1_p1-r7
openssh
Debian:12
 before 1:9.2p1-1
1:9.2p1-1
openssh
Debian:13
 before 1:9.2p1-1
1:9.2p1-1
Show 26 moreShow less
Affected packages
PackageAffectedFixed
openssh
Debian:14
 before 1:9.2p1-1
1:9.2p1-1
OpenSSH_jll
Julia
 8.9.0+0 up to 9.1.0+0
9.1.0+0
openssh
openEuler:22.03-LTS
 before 8.8p1-16.oe2203
8.8p1-16.oe2203
openssh
openEuler:22.03-LTS-SP1
 before 8.8p1-18.oe2203sp1
8.8p1-18.oe2203sp1
openssh-askpass
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-askpass-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-clients-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-keycat-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-server-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-sk-dummy-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
pam_ssh_agent_auth
Red Hat:enterprise_linux:9::appstream
 before 0:0.10.4-5.29.el9_2
0:0.10.4-5.29.el9_2
pam_ssh_agent_auth-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.10.4-5.29.el9_2
0:0.10.4-5.29.el9_2
openssh
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-askpass-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-clients
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-clients-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-keycat
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-keycat-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-server
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-server-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
openssh-sk-dummy-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:8.7p1-29.el9_2
0:8.7p1-29.el9_2
pam_ssh_agent_auth-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:0.10.4-5.29.el9_2
0:0.10.4-5.29.el9_2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubBusiness1sg00d/CVE-2023-251362023-09-04
PoC in GitHubChristbowel/CVE-2023-251362023-02-22
PoC in GitHubH4K6/CVE-2023-251362023-06-30
PoC in GitHubLane0218/CVE-2023-25136-PoC2025-11-18
PoC in GitHubadhikara13/CVE-2023-251362023-04-18
PoC in GitHubaxylisdead/CVE-2023-25136_POC2023-06-03
PoC in GitHubjfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free2023-02-07
PoC in GitHubmalvika-thakur/CVE-2023-251362023-09-21
PoC in GitHubmrmtwoj/CVE-2023-251362025-01-16
PoC in GitHubnhakobyan685/CVE-2023-251362023-04-28
PoC in GitHubticofookfook/CVE-2023-251362023-02-14

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25136 is a medium vulnerability (CVSS 6.5) in Openbsd Openssh, published February 3, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 89.8%, the 99th percentile. Fixed in openssh 8.7p1-29.el9_2.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open