CVE-2016-6515: OpenSSH sshd password auth lacks length limit, enabling crypt CPU DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated, low-complexity availability impact with public exploit code and very high EPSS, though it is not in KEV and only causes denial of service.

What it is

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication. A remote attacker can send an arbitrarily long password string, forcing the server to spend excessive CPU in the crypt hashing routine. This is an improper input validation flaw (CWE-20) that degrades or denies SSH service availability.

Impact

An attacker can consume crypt CPU resources on the SSH daemon, causing a denial of service that slows or blocks legitimate SSH logins. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

Reachable over the network against sshd when password authentication is enabled, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required, since the long password is submitted during the authentication attempt itself.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.58568, 99th percentile) and a public Exploit-DB entry (40888) plus a Packet Storm writeup exist, indicating exploit code is publicly available.

What to do

• Upgrade OpenSSH to 7.3 or later, or apply the vendor patch (commit fcd135c9df440bcd2d5870405ad3311743d78d97) and distribution errata such as RHSA-2017:2029.
• Disable password authentication in sshd_config and require key-based authentication where operationally feasible.
• Limit SSH exposure with firewall rules, network ACLs or a jump host so only trusted sources can reach port 22.
• Apply rate limiting or connection throttling on SSH to blunt repeated authentication attempts.

Detection

• Monitor sshd logs for authentication failures with unusually large or malformed password inputs.
• Alert on sustained high CPU usage in sshd processes, especially correlated with repeated connection attempts from a single source.
• Baseline and track SSH authentication request sizes and rates per source IP for anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.