Denial of Service Vulnerability in Erlang OTP SSH Transport Layer

CVE-2026-23943

What is CVE-2026-23943?

A vulnerability exists in the Erlang OTP SSH transport layer due to improper handling of highly compressed data, referred to as a compression bomb. This flaw allows attackers to exploit the SSH protocol's use of legacy zlib compression, leading to significant resource exhaustion via Denial of Service attacks. The SSH transport layer decompresses attacker-controlled payloads pre-authentication without any size limitation, risking memory depletion in affected environments. Both the zlib and zlib@openssh.com compression algorithms are vulnerable, with the former allowing unauthenticated attacks right after key exchange and the latter permitting authenticated attacks post-authentication. This can lead to rapid memory exhaustion, particularly in memory-constrained systems, as each SSH packet may inflate to approximately 255 MB from just 256 KB of wire data.

References