Vulnerability record · CVE-2025-70034 · published 9 March 2026

CVE-2025-70034: Mscdex ssh2 inefficient regular expression (redos) vulnerability

Mscdex · Ssh2

An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in mscdex ssh2 v1.17.0.

7.5 CVSS 3.1 High EPSS 0.34% · top 75.3% CWE-1333 · Inefficient regular expression (ReDoS)

7.5CVSS 3.1 base score

0.34%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in mscdex ssh2 v1.17.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ssh2 Mscdex

References

Link	Tags
https://gist.github.com/zcxlighthouse/78a0d9b7fcae20294076e8b24f763ce5	Third Party Advisory
https://github.com/mscdex	Product
https://github.com/mscdex/ssh2	Product

Track CVE-2025-70034 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2025-70034), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.