Description
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Published: 2026-10-06
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
First Time appeared Openbsd
Openbsd openssh
Weaknesses CWE-409
CPEs cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Vendors & Products Openbsd
Openbsd openssh
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Openbsd Openssh
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-06T20:52:39.850Z

Reserved: 2026-10-06T20:52:39.482Z

Link: CVE-2026-106585

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T21:17:19.663

Modified: 2026-10-06T21:17:19.663

Link: CVE-2026-106585

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)