Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-106582: OpenSSH before 10.6 may allow unsafe compression

CVE-2026-106582 · published 12 days ago

Summary

Older versions of OpenSSH (including OpenSSH from OpenBSD, Canonical and Debian packages) let a compression feature run when it should be disabled. This can let attackers infer or tamper with data exchanged over SSH. Upgrade to OpenSSH 10.6 or later, or turn off compression in the SSH configuration, to remove the risk.

What to do

Update bellsoft openssh to version 9.1_p1-r16.
Update bellsoft openssh to version 10.6_p1-r0.
Update openssh to version 9.1_p1-r16.
Update openssh to version 10.6_p1-r0.
Update openbsd openssh to version 10.6 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	openbsd	openssh	< 10.6
Ubuntu:Pro:14.04:LTS	canonical	openssh	All versions
Ubuntu:18.04:LTS	canonical	openssh-ssh1	All versions
Debian:14	debian	openssh-gssapi	All versions
Debian:12	debian	openssh	All versions
Alpaquita:23	bellsoft	openssh	>= 9.1_p1-r3, < 9.1_p1-r16 Fix: upgrade to 9.1_p1-r16
Alpaquita:25	bellsoft	openssh	>= 10.0_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
Alpaquita:stream	bellsoft	openssh	>= 9.3_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
BellSoft Hardened Containers:23	–	openssh	>= 9.1_p1-r3, < 9.1_p1-r16 Fix: upgrade to 9.1_p1-r16
BellSoft Hardened Containers:25	–	openssh	>= 10.0_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
BellSoft Hardened Containers:stream	–	openssh	>= 9.3_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0

Original advisory text

BELL-CVE-2026-106582

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

References

https://ubuntu.com/security/CVE-2026-106582 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-106582 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-106582 Vendor Advisory
https://docs.bell-sw.com/security/cves/CVE-2026-106582 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-1065... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-106582 Vendor Advisory
https://www.openssh.org/releasenotes.html#10.6 Third Party Advisory
https://arxiv.org/abs/2609.07709 URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-514Covert Channel

Timeline

Published7 Oct 2026

Updated17 Oct 2026

First seen6 Oct 2026

Sources

CVE-2026-106582 · NVD

CVE-2026-106582 · MITRE

UBUNTU-CVE-2026-106582 · OSV

DEBIAN-CVE-2026-106582 · OSV

BELL-CVE-2026-106582 · OSV

CVE-2026-106582 · OSV

Track software like this

Free during beta