CVE-2026-110927: Openssh: openssh: a compressed payload can expand past the maximum packet size
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
Other sources
A flaw was found in OpenSSH. uncompressbuffer could keep growing the output buffer inside the inflate loop until it passed the maximum packet size. The fix returns SSHERRINVALIDFORMAT once the buffer reaches PACKETMAXSIZE. This applies only after compression has been negotiated. The extra memory stays in that connection's process. This is not a demonstrated memory-corruption flaw, and it is a different bug and reporter from the LZ77 dictionary leak.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
The attacker needs to authenticate with low privileges and negotiate compression for their SSH connection. No user interaction is required.
Which deployments are exposed?
Only connections for which SSH compression has been negotiated are affected. The memory growth is confined to the process handling the offending connection.
What is the practical impact of exploitation?
A compressed payload can cause memory consumption to grow beyond the maximum packet size, potentially affecting availability of the connection-handling process. The provided information does not describe memory corruption, confidentiality impact, or integrity impact.
What behavior indicates that a fix is present?
The fix causes processing to return SSH_ERR_INVALID_FORMAT when the decompressed output buffer reaches PACKET_MAX_SIZE.