critical CVSS 9 EPSS 59% Public exploit available

CVE-2016-6515·OpenSSH vulnerability

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

Severity
critical
Software
OpenSSH
Fixed in
1:7.3p1-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 59% — in the top 0.9% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 1:7.3p1-1

Fixed in: 1:7.3p1-1

How to fix this CVE

Update OpenSSH server to version 7.3p1-1 or later to patch the password authentication denial of service vulnerability. This fix enforces reasonable limits on password lengths, preventing attackers from exhausting CPU resources through cryptographic processing of extremely long input strings. Affected systems running OpenSSH versions prior to 7.3p1-1 should prioritize this update as it addresses a critical availability risk.

sudo dnf update openssh-server

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /auth or SSH protocol handshake followed by AUTH_PASSWORD request with payload exceeding 1MB; sshd process CPU usage spikes to 100% with concurrent auth attempts; log entries: "Invalid user" or authentication failures with extremely large input strings in /var/log/auth.log

How to check if you are affected

  1. Check OpenSSH version: ssh -V or sshd -v
  2. Verify installed package version: dpkg -l | grep openssh-server (Debian/Ubuntu) or rpm -qa | grep openssh-server (RHEL/CentOS/Amazon Linux)
  3. Review /var/log/auth.log (Linux) or /var/log/secure (RHEL/CentOS) for repeated failed authentication attempts with unusually large password payloads
  4. Confirm patched version is running: systemctl restart ssh && ssh -V to verify the daemon is version 7.3p1-1 or later

FAQ

What is CVE-2016-6515?

CVE-2016-6515 is a denial of service vulnerability in OpenSSH's password authentication mechanism that fails to validate password length limits, allowing attackers to submit extremely long passwords that consume excessive CPU during cryptographic processing.

Is CVE-2016-6515 being actively exploited?

According to CISA, CVE-2016-6515 is not listed as actively exploited in the wild; however, public exploits are available, making opportunistic exploitation possible.

What versions of OpenSSH are affected by CVE-2016-6515?

All versions of OpenSSH prior to 7.3p1-1 are vulnerable. The vulnerability was introduced in earlier versions and patched in the 7.3p1-1 release.

How do I check if my server is vulnerable to CVE-2016-6515?

Run 'ssh -V' or 'sshd -v' to display the version. If it is earlier than 7.3p1-1, the system is vulnerable. Cross-reference with 'dpkg -l openssh-server' or 'rpm -qa openssh-server' for package-level confirmation.

Does Defensia detect CVE-2016-6515?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2016-6515 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2024-6387CVSS 8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2016-6515. Free for 1 server.

Get started free