The issue is caused by a flaw in the SSH protocol message handling which allows an attacker to send connection protocol messages prior to authentication.

per https://www.openwall.com/lists/oss-security/2025/04/16/2