OpenSSH versions before 10.6 lack a check on the maximum packet length during decompression of highly compressed data. This flaw can cause the SSH daemon to consume excessive memory as it tries to decompress large inputs, potentially leading to a crash or severe slowdown. The weakness is a classic example of excessive resource consumption (CWE-409).

The vulnerability affects OpenSSH installed on OpenBSD systems running any version of the OpenSSH server or client prior to release 10.6. Any user who has deployed these earlier releases on their systems is exposed. No specific sub‑versions are listed, so the risk applies broadly to all affected releases.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available. The vulnerability is classified as not being in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, with an attacker able to connect to the SSH service and send crafted compressed packets to trigger the exploit. Successful exploitation would result in resource exhaustion, causing the SSH service to become unresponsive and effectively yielding a denial‑of‑service condition. The lack of a known CAT indicates there is no confirmed public exploit at the time of this analysis, but the remote nature and moderate score warrant prompt remediation.