REDHAT-BUG-2553035: Medium severity OpenSSH OpenSSH vulnerability
A flaw was found in OpenSSH. Outbound compression used deflateInit with the default level, so every channel on a connection shared one LZ77 search buffer. A peer who can write on one channel can recover plaintext from another channel by observing ciphertext lengths, as described in "Crossing the Streams" (Fabian Bäumer and Marcus Brinkmann, 2026). The fix switches outbound compression to ZHUFFMANONLY, which removes LZ77 matching and lowers the compression ratio. The RHEL maintainer will take that fix. The OpenSSH client does not offer compression by default. The server zlib default is delayed compression, which applies only if the client offers it.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
The OpenSSH client is not exposed by default because it does not offer compression by default. On the server, the default zlib setting uses delayed compression, so compression is used only when the client offers it.
What does an attacker need to exploit this issue?
The attacker must be a peer that can write on one SSH channel while plaintext from another channel is sent over the same connection. They infer that plaintext by observing ciphertext lengths.
What mitigation is available if the fix cannot be applied immediately?
Avoid enabling or offering SSH compression, since the issue depends on outbound compression and shared LZ77 state. The planned fix changes outbound compression to Z_HUFFMAN_ONLY, removing LZ77 matching.