CVE-2026-110926: Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
A flaw was found in OpenSSH. Outbound compression used deflateInit with the default level, so every channel on a connection shared one LZ77 search buffer. A peer who can write on one channel can recover plaintext from another channel by observing ciphertext lengths, as described in "Crossing the Streams" (Fabian Bäumer and Marcus Brinkmann, 2026). The fix switches outbound compression to ZHUFFMANONLY, which removes LZ77 matching and lowers the compression ratio. The RHEL maintainer will take that fix. The OpenSSH client does not offer compression by default. The server zlib default is delayed compression, which applies only if the client offers it.
Other sources
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Switch outbound compression from the default deflate/LZ77 mode to Z_HUFFMAN_ONLY to remove LZ77 matching across channels.
OpenSSH outbound compression compression strategy = Z_HUFFMAN_ONLY
Event History
Frequently Asked Questions
When is an OpenSSH connection exposed to this issue?
The issue applies only when compression is negotiated for the connection. The OpenSSH client does not enable compression by default, and the server's default zlib setting uses delayed compression, which only takes effect when the client offers compression.
What access does an attacker need to recover plaintext?
The attacker must be a peer on the same SSH connection and be able to write data on one channel. They can use chosen plaintext and ciphertext-length observations to recover plaintext from another channel sharing that connection's compression dictionary.
What is the mitigation described for affected deployments?
The described fix changes outbound compression to Z_HUFFMAN_ONLY, removing LZ77 matching between channel data at the cost of a lower compression ratio. If that fix is not yet available, avoiding negotiated SSH compression prevents the shared LZ77 dictionary condition.