CVE-2026-106582: Low severity OpenSSH sshd vulnerability

Q: Which deployments are affected?

The issue affects both OpenSSH sshd and the OpenSSH ssh client in versions before 10.6.

Q: What access does an attacker need?

The vector is network-based and requires no privileges or user interaction, but exploitation has high attack complexity.

Q: What is the expected impact?

The stated impact is limited to low confidentiality impact. No integrity or availability impact is listed.

Q: What should be done to remediate the issue?

Upgrade OpenSSH sshd and ssh to version 10.6 or later.

Published Oct 6, 2026

Updated

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

Affected Software

7 affected componentsFixes available

OpenSSH sshd<10.6

OpenSSH ssh<10.6

OpenBSD OpenSSH<10.6

debian/openssh<=1:9.2p1-2+deb12u10, <=1:9.2p1-2+deb12u9, <=1:10.0p1-7+deb13u4, <=1:10.0p1-7+deb13u2

1:10.6p1-1

debian/openssh-gssapi

1:10.6p1-1

All of the following

azurelinux/openssh<9.8p1-11

9.8p1-11

Microsoft Azure Linux=3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/openssh to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade debian/openssh-gssapi to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade azurelinux/openssh to a version that resolves this vulnerability.
Fixed in 9.8p1-11
Upgrade
Upgrade OpenSSH to a version that resolves this vulnerability.
Fixed in 10.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:35 PM

Data Sourced

via MITRE·08:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeaknessAffected Software

Oct 8, 2026

Data Sourced

via Microsoft·08:13 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

The issue affects both OpenSSH sshd and the OpenSSH ssh client in versions before 10.6.

What access does an attacker need?

The vector is network-based and requires no privileges or user interaction, but exploitation has high attack complexity.

What is the expected impact?

The stated impact is limited to low confidentiality impact. No integrity or availability impact is listed.

What should be done to remediate the issue?

Upgrade OpenSSH sshd and ssh to version 10.6 or later.

CVE-2026-106582: Low severity OpenSSH sshd vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the expected impact?

What should be done to remediate the issue?

Company

Resources

Contact