Sploitus

CVE-2016-6515

8 known exploits for CVE-2016-6515

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

Affected products
Alt Linux, Centos, Freebsd, Ibm Aix, Openssh, Red Hat, Suse, Ubuntu
Openbsd Openssh
≤ 7.2
Fix
Available
CVSS 2.0
7.8 HIGH
CVSS 3.1
7.5 HIGH
EPSS
58.6% (99th percentile)
Weakness
CWE-20
NVD status
Modified
Published
2016-08-07
CVE-2016-6515 at NVD
Authoritative description, scoring and affected products

8 known exploits for CVE-2016-6515

Proof-of-concept code and exploit modules indexed by Sploitus

exploit-CVE-2016-6515
2026-08-28 KitPloitKITPLOIT
openssh_dos
2026-08-26 KitPloitKITPLOIT
cve-2016-6515
2026-08-26 KitPloitKITPLOIT
Exploit for Improper Input Validation in Openbsd Openssh
2016-12-09 opsxcqGITHUB
OpenSSH 7.2 Denial Of Service
2016-12-08 Kashinath TPACKETSTORMPython
OpenSSH 7.2 - Denial of Service Exploit
2016-12-07 Kashinath TZDTPython
OpenSSH 7.2 - Denial of Service
2016-12-07 SecPod ResearchEXPLOITPACKPython
OpenSSH 7.2 - Denial of Service
2016-12-07 SecPod ResearchEXPLOITDBPython