CVE-2026-23943: Pre-auth SSH DoS via unbounded zlib inflate
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (sshtransport modules) allows Denial of Service via Resource Depletion.
The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.
Two compression algorithms are affected:
zlib: Activates immediately after key exchange, enabling unauthenticated attacks zlib@openssh.com: Activates post-authentication, enabling authenticated attacks
Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.
This vulnerability is associated with program files lib/ssh/src/sshtransport.erl and program routines sshtransport:decompress/2, sshtransport:handlepacketpart/4.
This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.
Other sources
Pre-auth SSH DoS via unbounded zlib inflate
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Erlang OTP ssh (ssh_transport modules)to a version that resolves this vulnerability.Fixed in 28.4.1 - Upgrade
Upgrade
Erlang OTP ssh (ssh_transport modules)to a version that resolves this vulnerability.Fixed in 27.3.4.9 - Upgrade
Upgrade
Erlang OTP ssh (ssh_transport modules)to a version that resolves this vulnerability.Fixed in 26.2.5.18 - Upgrade
Upgrade
ssh (from 3.0.1)to a version that resolves this vulnerability.Fixed in 5.5.1 - Upgrade
Upgrade
ssh (from 5.2.11.6)to a version that resolves this vulnerability.Fixed in 5.2.11.6 - Upgrade
Upgrade
ssh (from 5.1.4.14)to a version that resolves this vulnerability.Fixed in 5.1.4.14 - Compensating control
Mitigate pre-auth SSH DoS by limiting network access to the SSH service (e.g., restrict inbound SSH connections at the firewall/ACL to trusted sources) to reduce unauthenticated attempts that trigger unbounded zlib inflate and memory exhaustion.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23943?
CVE-2026-23943 has been classified as a Denial of Service vulnerability due to resource depletion.
How do I fix CVE-2026-23943?
To mitigate CVE-2026-23943, update your Erlang/OTP and SSH versions to versions higher than the affected ones.
What types of systems are affected by CVE-2026-23943?
CVE-2026-23943 affects Erlang/OTP versions from 17.0 to 28.4.1 and SSH versions from 3.0.1 to 5.5.1.
Can CVE-2026-23943 be exploited remotely?
Yes, CVE-2026-23943 can be exploited remotely through a pre-authentication SSH connection.
What is the nature of the attack vector for CVE-2026-23943?
CVE-2026-23943 is exploited via unbounded zlib inflate leading to denial of service from highly compressed data.