Description
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.

The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.

Two compression algorithms are affected:

* zlib: Activates immediately after key exchange, enabling unauthenticated attacks
* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks

Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.

This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and 26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.
Published: 2026-03-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability arises from improper handling of highly compressed data (compression bomb) in Erlang OTP SSH, where the SSH transport layer inflates zlib packets before authentication without any size limit. This unbounded decompression allows an attacker to send a small compressed payload that expands to hundreds of megabytes, consuming server memory and causing an out‑of‑memory termination or prolonged unavailability. The weakness is classified as CWE‑409: Excessive Resource Consumption, directly leading to a denial‑of‑service impact without granting code execution or data exfiltration capabilities.

Affected Systems

OTP releases from 17.0 through 28.4.1, 27.3.4.9, and 26.2.5.18 (corresponding to SSH libraries 3.0.1 to 5.5.1, 5.2.11.6, and 5.1.4.14) are affected when using the default SSH configuration. All deployments of these OTP releases are vulnerable.

Risk and Exploitability

The CVSS score is 6.9 indicating moderate severity. EPSS indicates exploitation probability below 1%, and the vulnerability is not listed in the CISA KEV catalog. Exfiltration of data or code execution is not possible; the attack is limited to memory exhaustion. The likely attack vector is remote, unauthenticated via the pre‑authentication zlib compression algorithm on the SSH port. An attacker with network connectivity can repeatedly send compressed packets to de memory and induce a denial‑of‑service. Authenticated exploitation is also possible via the zlib@openssh.com algorithm, but the impact remains a service outage.

Generated by OpenCVE AI on March 19, 2026 at 15:25 UTC.

Remediation

Vendor Workaround

Best workaround - Disable all compression: {preferred_algorithms, [{compression, ['none']}]} Alternative mitigations (less secure): * Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com): {modify_algorithms, [{rm, [{compression, ['zlib']}]}]} * Limit concurrent sessions (reduces attack surface but does not prevent exploitation): {max_sessions, N} % Cap total concurrent sessions (default is infinity)

OpenCVE Recommended Actions

  • Disable all SSH compression by setting {preferred_algorithms, [{compression, ['none']}]}.
  • If disabling all compression is not feasible, disable only the pre‑authentication zlib compression: {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}.
  • Limit the total number of concurrent SSH sessions with {max_sessions, N} to reduce the attack surface.

Generated by OpenCVE AI on March 19, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
References

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp

Fri, 13 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 09:30:00 +0000

Type Values Removed Values Added
Description Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@openssh.com: Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments. This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and 26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.
Title Pre-auth SSH DoS via unbounded zlib inflate
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-409
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-04-06T16:44:10.203Z

Reserved: 2026-01-19T14:23:14.343Z

Link: CVE-2026-23943

cve-icon Vulnrichment

Updated: 2026-03-13T16:01:44.722Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-13T19:54:15.783

Modified: 2026-04-06T17:17:08.773

Link: CVE-2026-23943

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T09:59:34Z

Weaknesses