CVE-2026-23943 — Improper Handling of Highly Compressed Data (Data Amplification) in OTP

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)6 documents6 sources
Severity
6.9MEDIUMNVD
EPSS
0.1%
top 67.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Erlang OTP
Timeline
PublishedMar 13

Description

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@op…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5erlang/otp3.0.1 — *+2

🔴Vulnerability Details

2
OSV
CVE-2026-23943: Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Re↗2026-03-13
▶
CVEList
Pre-auth SSH DoS via unbounded zlib inflate↗2026-03-13
▶

📋Vendor Advisories

2
Microsoft
Pre-auth SSH DoS via unbounded zlib inflate↗2026-03-10
▶
Debian
CVE-2026-23943: erlang - Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-23943 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-23943 — Erlang OTP vulnerability | cvebase