CVE-2026-106582
Received
Received - Intake
OpenSSH Pre-authentication Memory Corruption via LZ77
Vulnerability report for CVE-2026-106582, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: MITRE
Description
Description
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| OpenBSD | OpenSSH | 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-514 | A covert channel is a path that can be used to transfer information in a way not intended by the system's designers. |
