OpenSSH Alpine CVE-2025-61984
LOWAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown entry point
-
ExploitTrigger unspecified OpenSSH vulnerability
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Special element handling
|
| Exploitation Conditions | Exploitation conditions cannot be determined - no CVE description, CVSS vector, or CWE is available to identify required configuration, authentication level, network accessibility, or triggering conditions. No special conditions can be confirmed or ruled out. What IS known: no public exploit exists, EPSS is 0.01% (2nd percentile), and this is not listed in CISA KEV. Authentication requirements are not confirmed from available data. Defenders should monitor the Alpine Linux security tracker and upstream OpenSSH changelogs for CVE-2025-61984 disclosures to refine this assessment. |
| Impact | Real-world risk cannot be quantitatively assessed due to the near-total absence of technical disclosure. No CVSS vector is available, making it impossible to evaluate attack vector, complexity, required privileges, or user interaction. No CWE is assigned, so the vulnerability class is unknown. The EPSS score of 0.01% (2nd percentile) indicates extremely low exploitation probability relative to the broader CVE population, suggesting this is unlikely to see widespread automated exploitation in the near term. There is no active exploitation confirmed (not in CISA KEV) and no public proof-of-concept identified. The sole signal for prioritization is that a vendor patch has been released, which warrants upgrading as a precautionary measure. CRITICAL DATA GAP: The vulnerability description is a single-line patch notice with no technical detail - security teams should consult the Alpine Linux security tracker and upstream OpenSSH release notes for CVE-2025-61984 before making risk decisions. |
| Exploit ScenarioDerived | No exploit scenario can be constructed with confidence given the complete absence of technical vulnerability details - attack vector, required privileges, and affected components are all unknown. No public exploit or proof-of-concept has been identified at time of analysis. Upgrading to the patched package version is the recommended action pending further disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
OpenSSH on Alpine Linux received a security fix in package version 10.1_p1-r0, addressing an unspecified vulnerability tracked as CVE-2025-61984. The exact nature, attack vector, and impact of this vulnerability are not disclosed in available intelligence sources - no CVE description, CVSS score, or CWE classification has been published at time of analysis. EPSS probability is extremely low at 0.01% (2nd percentile), and no public exploit or CISA KEV listing has been identified.
RemediationAI
Upgrade the OpenSSH package on Alpine Linux to version 10.1_p1-r0 or later using the Alpine package manager: 'apk update && apk upgrade openssh'. This is the vendor-confirmed fix version per the Alpine Linux security report. No workarounds or compensating controls are documented in available data, as no technical details about the vulnerability mechanism have been disclosed. If immediate patching is operationally not feasible, consider restricting SSH access at the network perimeter (firewall rules limiting source IPs to known management hosts) as a generic precaution - note this does not remediate the underlying vulnerability. Consult https://security.alpinelinux.org/ for the official advisory and any additional guidance.
Affected ProductsAI
OpenSSH as packaged for Alpine Linux is affected. The fix was introduced in Alpine package version 10.1_p1-r0, meaning all prior Alpine Linux packages of OpenSSH below this version are potentially vulnerable. No CPE strings, specific Alpine release branches (e.g., Alpine 3.x edge), or additional affected platform details were provided in the available intelligence. Affected version ranges across Alpine release streams (stable, edge) are not confirmed from available data - consult the Alpine Linux security advisory at https://security.alpinelinux.org/ for precise branch-level scope.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenSSH is the de facto standard implementation of the Secure Shell (SSH) protocol, widely deployed for remote administration and encrypted file transfer. Alpine Linux packages OpenSSH using its own versioning scheme; the fix version 10.1_p1-r0 corresponds to upstream OpenSSH 10.1p1 packaged for Alpine. Without a published CWE or CVE description, the root cause class - whether memory corruption, authentication bypass, privilege escalation, or another category - cannot be determined from available data. The vulnerability is reported exclusively by the Alpine Linux vendor through its own advisory channel.
Know when SSH gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: openssh fixed in 10.1_p1-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
GitHub PoC
Exploit-DB