CVE-2016-8858
openssh: Memory exhaustion due to unregistered KEXINIT handler after receiving message
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 17, 2016
Updated · May 30, 2026
Description
The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
Statement
The Red Hat Product Security Team does not consider this issue to be a security flaw, for more information please refer to https://bugzilla.redhat.com/show_bug.cgi?id=1384860#c5
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS 2.0 · 5AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE not specified