Loading vulnerability…
Compression-related information disclosure in OpenSSH
CVE-2026-106582 is an information-disclosure vulnerability in the ssh client and sshd server components of OpenSSH before version 10.6. Affected versions permit use of an LZ77 dictionary coder for compression despite security concerns identified in the research paper "Crossing the Streams." Use of the affected compression mechanism can expose sensitive information. The vulnerability is assessed as a high-complexity network attack with limited confidentiality impact.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information through OpenSSH compression. The CVSS v3.0 assessment is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating low confidentiality impact and no assessed integrity or availability impact. No known exploits are reported.
If you can’t patch tonight, do this now.
Where operationally feasible, disable SSH compression on affected clients and servers to avoid use of the LZ77 dictionary coder. This is a mechanism-based precaution; a vendor-validated workaround is not specified.
Patch, then assume compromise.
Upgrade OpenSSH to version 10.6 or later, or install the applicable distribution security update containing the backported fix. For Echo packages, update openssh and related packages to version 1:10.6p1-1 or later. Under Ubuntu USN-8928-1, update openssh-client and openssh-server to 1:10.2p1-2ubuntu3.8 on Ubuntu 26.04 LTS, 1:9.6p1-3ubuntu13.20 on Ubuntu 24.04 LTS, or 1:8.9p1-3ubuntu0.18 on Ubuntu 22.04 LTS. On Ubuntu 26.04 LTS, also update installed openssh-client-gssapi and openssh-server-gssapi packages to 1:10.2p1-2ubuntu3.8.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.