The flaw resides in fail2ban’s SSHD filter configuration, which allows an injected 'on <token>' suffix after the host address field in the username portion of OpenSSH log messages. By submitting an SSH login attempt with a crafted username such as 'x VICTIM-SOURCE-IP-ADDRESS on', an unauthenticated attacker can cause fail2ban to associate failed login attempts with an arbitrary source IP address, leading the service to ban that address. This misattribution results in denial of service for legitimate users and is catalogued as an input handling weakness (CWE‑117).

The vulnerability affects fail2ban versions 0.10.5 through 1.1.1 that do not include the upstream commit ddd879d22664904ace24e1255ac6571808c58187. All releases in that range, regardless of the SSHD filter mode, are susceptible. The issue is present in the default SSHD filter mode and all affected releases up to 1.1.1 that lack the patch.

The nominal CVSS score of 5.3 indicates moderate severity. No EPSS score is provided, so the likelihood of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw remotely by sending loggable SSH login attempts that contain the malicious username, requiring only network access to the SSH port. The exploit does not require elevated privileges or physical access, and the attack vector is straightforward via normal SSH traffic.