CVE-2026-106585: Medium severity OpenSSH OpenSSH vulnerability
Published Oct 6, 2026
·Updated
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Affected Software
1 affected component
OpenSSH OpenSSH<10.6
Event History
Oct 6, 2026
CVE Published
via MITRE·08:52 PM
Data Sourced
via MITRE·08:52 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What would an attacker need to exploit this issue?
The vector is network-based and requires no privileges or user interaction. Exploitation involves sending highly compressed data that exceeds the maximum packet length during decompression.
2
Which OpenSSH components are affected?
The issue affects both sshd and ssh in OpenSSH versions before 10.6.
3
What is the potential impact?
The reported impact is limited to integrity and availability, with no confidentiality impact indicated. The severity is medium with a CVSS score of 6.5.