CVE-2026-110927: Openssh: openssh: a compressed payload can expand past the maximum packet size
A flaw was found in OpenSSH. uncompressbuffer could keep growing the output buffer inside the inflate loop until it passed the maximum packet size. The fix returns SSHERRINVALIDFORMAT once the buffer reaches PACKETMAXSIZE. This applies only after compression has been negotiated. The extra memory stays in that connection's process. This is not a demonstrated memory-corruption flaw, and it is a different bug and reporter from the LZ77 dictionary leak.
Other sources
CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585.
— Launchpad
Openssh: openssh: a compressed payload can expand past the maximum packet size
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
The attacker needs to authenticate with low privileges and negotiate compression for their SSH connection. No user interaction is required.
Which deployments are exposed?
Only connections for which SSH compression has been negotiated are affected. The memory growth is confined to the process handling the offending connection.
What is the practical impact of exploitation?
A compressed payload can cause memory consumption to grow beyond the maximum packet size, potentially affecting availability of the connection-handling process. The provided information does not describe memory corruption, confidentiality impact, or integrity impact.
What behavior indicates that a fix is present?
The fix causes processing to return SSH_ERR_INVALID_FORMAT when the decompressed output buffer reaches PACKET_MAX_SIZE.