Description
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
Published: 2026-10-06
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Upgrade
AI Analysis

Impact

The vulnerability allows the OpenSSH daemon and client to employ an LZ77 dictionary coder that should not be used, contrary to recent research findings. This unsanctioned use can lead to an information‑disclosure side‑channel via shared compression resources, as well as potential instability or crashes when processing compressed data. The weakness is identified as CWE-205 (Information Disclosure Through Shared Resource) and CWE-514 (Improper Use of Compression).

Affected Systems

OpenBSD OpenSSH, any release prior to version 10.6, regardless of the underlying operating system.

Risk and Exploitability

The CVSS score of 3.7 indicates a low‑severity vulnerability, suggesting limited impact on confidentiality, integrity, or availability. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation at this time. The likely attack vector is remote; an attacker could initiate or manipulate an SSH session to trigger the unsanctioned dictionary coder, potentially exposing hidden data through side‑channel leakage or causing a service disruption.

Generated by OpenCVE AI on October 20, 2026 at 06:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update OpenSSH to version 10.6 or later to remove the LZ77 dictionary coder usage.
  • Configure the SSH daemon to disable compression or use only secure compression algorithms, if configuration controls are available.
  • After the update, monitor SSH logs and system stability for any indications of crashes or anomalous behavior caused by compression processing.

Generated by OpenCVE AI on October 20, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8928-1 OpenSSH vulnerabilities
Ubuntu USN Ubuntu USN USN-8937-1 OpenSSH vulnerabilities
History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Unsanctioned LZ77 Dictionary Coder Usage in OpenSSH openssh: openssh: Information disclosure via shared compression side-channel
Weaknesses CWE-205
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unsanctioned LZ77 Dictionary Coder Usage in OpenSSH

Tue, 06 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
First Time appeared Openbsd
Openbsd openssh
Weaknesses CWE-514
CPEs cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Vendors & Products Openbsd
Openbsd openssh
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Openbsd Openssh
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-07T14:05:31.972Z

Reserved: 2026-10-06T20:35:32.203Z

Link: CVE-2026-106582

cve-icon Vulnrichment

Updated: 2026-10-07T14:05:25.176Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T21:17:19.370

Modified: 2026-10-13T14:57:12.573

Link: CVE-2026-106582

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T20:35:32Z

Links: CVE-2026-106582 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:30:10Z

Weaknesses