OpenSSH Packet Decompression Flaw in SSHD and SSH Affecting Previously Released Versions
CVE-2026-106585

6.5MEDIUM

Key Information:

Vendor

OpenBSD
Status
Openssh
Vendor
CVE Published:
6 October 2026

What is CVE-2026-106585?

A vulnerability exists in the OpenSSH implementation of sshd and ssh that omits checks for maximum packet length during the decompression of highly compressed data. This oversight could potentially lead to resource exhaustion or other related issues, making it imperative for users to apply updates to protect their systems from potential exploitation.

Affected Version(s)

OpenSSH 0 < 10.6

References

https://www.openssh.org/releasenotes.html#10.6

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.