SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be re...

{
  "id": "3d7a500533d185b6ab43079ecd7b9669f9d5130e579b82a4f26295e9030141d9",
  "url": "https://osv.dev/vulnerability/CLEANSTART-2026-ET25167",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be re...",
    "summary": "CVE-2025-22869 affects multiple packages. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. See references for individual vulnerability details.",
    "evidence": "osv:CLEANSTART-2026-ET25167",
    "products": [
      {
        "name": {
          "value": "ollama-fips",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.40.0-r3",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "ollama-fips",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.40.0-r3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "ollama-fips",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.34.4-r2",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "ollama-fips",
          "evidence": "/affected/3/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.34.4-r2",
            "evidence": "/affected/3/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CLEANSTART-2026-ET25167",
      "aliases": [
        "CLEANSTART-2026-ET25167"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.40.0-r3"
                }
              ]
            }
          ],
          "package": {
            "name": "ollama-fips",
            "purl": "pkg:apk/cleanstart/ollama-fips?arch=x86_64",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-ET25167.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.40.0-r3"
                }
              ]
            }
          ],
          "package": {
            "name": "ollama-fips",
            "purl": "pkg:apk/cleanstart/ollama-fips?arch=aarch64",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-ET25167.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.34.4-r2"
                }
              ]
            }
          ],
          "package": {
            "name": "ollama-fips",
            "purl": "pkg:apk/cleanstart/ollama-fips?arch=x86_64",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-ET25167.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.34.4-r2"
                }
              ]
            }
          ],
          "package": {
            "name": "ollama-fips",
            "purl": "pkg:apk/cleanstart/ollama-fips?arch=aarch64",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-ET25167.json"
          }
        }
      ],
      "modified": "2026-10-09T01:00:03.187230132Z",
      "provider": "osv",
      "upstream": [
        "CVE-2025-22869"
      ],
      "references": [
        "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ET25167.json",
        "https://osv.dev/vulnerability/CVE-2025-22869",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-22869"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2025-22869",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 108028,
  "published_at": "2026-10-09T00:36:55.262+00:00"
}