CVE-2025-61984 - CVE House
Back to Database
Status published Low CVE-2025-61984

ssh in OpenSSH before 10.1 allows control characters in usernames...

Vulnerability Description

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61984

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenBSD

View All →
CVE-2025-61985
ssh in OpenSSH before 10.1 allows the '\0' character in...
Low 3.6
CVE-2025-32728
In sshd in OpenSSH before 10.0, the DisableForwarding directive does...
Medium 4.3
CVE-2025-30334
OpenBSD wg(4) kernel crash
High 7.1
CVE-2024-11149
OpenBSD vmm GDTR limits
Medium 6.2
CVE-2024-11148
OpenBSD httpd(8) null dereference
High 8.7

Affected Vendor

Affected Software

OpenSSH
Vulnerable Versions:
0

Timeline

Official Publish: October 6th, 2025
Last Modified: July 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-159

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.