CVE-2026-106582

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: MITRE

Description

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106582

Affected Vendors & Products

Vendor	Product	Version / Range
openbsd	openssh	to 10.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-514	A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenSSH before version 10.6 allows an LZ77 dictionary coder to be used despite warnings from research showing potential security risks. The issue relates to compression methods in SSH that could be exploited.

Detection Guidance

To detect this vulnerability, check the OpenSSH version on your system. If it is before 10.6, the system is vulnerable. Use commands like 'ssh -V' or 'dpkg -l | grep openssh-server' on Linux to verify the version.

Impact Analysis

An attacker might exploit this to gain unauthorized access or extract sensitive data during SSH sessions. The low CVSS score suggests limited impact but still poses a risk for information disclosure.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a technical implementation detail in OpenSSH's LZ77 compression. No evidence suggests it leads to data breaches or unauthorized access that would violate these regulations.

Mitigation Strategies

Upgrade OpenSSH to version 10.6 or later to address the LZ77 dictionary coder issue.

Hi! I’m here to help you understand CVE-2026-106582. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70