This vulnerability (CVE-2025-61985) affects OpenSSH clients that accept null (\0) characters in ssh:// URIs. If a ProxyCommand is configured, the presence of null characters can cause the command parser to misinterpret the URI, potentially resulting in execution of unintended shell commands. The vulnerability requires a local attacker or user to supply a crafted ssh:// URI and have ProxyCommand enabled. Red Hat classifies the impact as moderate and notes that exploitation depends on specific configurations. The advisory references CWE-158 (Improper Neutralization of Null Byte or NUL Character) and provides links to further details. No CVSS score is provided by Red Hat, but their internal score is 5.3 (moderate). There is no explicit statement about patch availability or fixes in the provided advisory content.

The vulnerability could allow an attacker to execute unintended shell commands via manipulation of ssh:// URIs containing null characters when ProxyCommand is enabled. This could compromise the integrity of the affected system. However, exploitation requires a specific configuration and user interaction with crafted URIs. The impact is moderate and limited to environments where ProxyCommand is used with untrusted ssh:// URIs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using ProxyCommand with untrusted ssh:// URIs or sanitize input to prevent null characters. Monitor Red Hat's official advisories for updates and patches addressing this issue.