CVE-2026-106585
published 2026-10-06CVE-2026-106585: In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
0.19%
8.1th percentile
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.6 | 10.6 |
| openbsd | openssh | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| ubuntu | openssh | — | — |
| ubuntu | openssh-gssapi | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenBSD OpenSSH up to 10.5 Decompression buffer overflow (EUVD-2026-94014)
vuldb·2026-10-07·CVSS 6.5
CVE-2026-106585 [MEDIUM] OpenBSD OpenSSH up to 10.5 Decompression buffer overflow (EUVD-2026-94014)
A vulnerability described as critical has been identified in OpenBSD OpenSSH up to 10.5. Affected by this vulnerability is an unknown functionality of the component Decompression. The manipulation results in buffer overflow.
This vulnerability was named CVE-2026-106585. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
ghsa_unreviewed·2026-10-06
CVE-2026-106585 [MEDIUM] CWE-409 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 6.5
CVE-2026-106553 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 6.5
CVE-2026-106552 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote
attacker controlling the server could possibly use this issue to write
files to unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous
failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Red Hat
openssh: openssh: Denial of service via oversized decompressed packets
vendor_redhat·2026-10-06·CVSS 6.5
CVE-2026-106585 [MEDIUM] CWE-409 openssh: openssh: Denial of service via oversized decompressed packets
openssh: openssh: Denial of service via oversized decompressed packets
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
A flaw was found in OpenSSH. A remote attacker can trigger a denial of service (DoS) or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet length limits, allowing oversized packets to be processed.
Statement: A flaw of moderate impact was found in OpenSSH, where the sshd server and ssh client do not verify that decompressed payloads remain within the maximum supported packet length when processing highly co
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106585 openssh: openssh: Denial of service via oversized decompressed packets [fedora-all]
bugzilla·2026-10-19·CVSS 6.5
CVE-2026-106585 [MEDIUM] CVE-2026-106585 openssh: openssh: Denial of service via oversized decompressed packets [fedora-all]
CVE-2026-106585 openssh: openssh: Denial of service via oversized decompressed packets [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Discussion:
*** Bug 2553372 has been marked as a duplicate of this bug. ***
Bugzilla
CVE-2026-106585 openssh: openssh: Denial of service via oversized decompressed packets
bugzilla·2026-10-06·CVSS 6.5
CVE-2026-106585 [MEDIUM] CVE-2026-106585 openssh: openssh: Denial of service via oversized decompressed packets
CVE-2026-106585 openssh: openssh: Denial of service via oversized decompressed packets
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
2026-10-06
Published