CVE-2026-110926: Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
A flaw was found in OpenSSH. Outbound compression used deflateInit with the default level, so every channel on a connection shared one LZ77 search buffer. A peer who can write on one channel can recover plaintext from another channel by observing ciphertext lengths, as described in "Crossing the Streams" (Fabian Bäumer and Marcus Brinkmann, 2026). The fix switches outbound compression to ZHUFFMANONLY, which removes LZ77 matching and lowers the compression ratio. The RHEL maintainer will take that fix. The OpenSSH client does not offer compression by default. The server zlib default is delayed compression, which applies only if the client offers it.
Other sources
CVE-2026-110926 has been marked as a duplicate of CVE-2026-106582.
— Launchpad
Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Switch outbound compression to Z_HUFFMAN_ONLY to remove LZ77 matching across channels.
OpenSSH outbound compression compression strategy = Z_HUFFMAN_ONLY
Event History
Frequently Asked Questions
When is an OpenSSH connection exposed to this issue?
The issue applies only when compression is negotiated for the connection. The OpenSSH client does not enable compression by default, and the server's default zlib setting uses delayed compression, which only takes effect when the client offers compression.
What access does an attacker need to recover plaintext?
The attacker must be a peer on the same SSH connection and be able to write data on one channel. They can use chosen plaintext and ciphertext-length observations to recover plaintext from another channel sharing that connection's compression dictionary.
What is the mitigation described for affected deployments?
The described fix changes outbound compression to Z_HUFFMAN_ONLY, removing LZ77 matching between channel data at the cost of a lower compression ratio. If that fix is not yet available, avoiding negotiated SSH compression prevents the shared LZ77 dictionary condition.