CVE-2026-106582
Description
A flaw was found in OpenSSH. When session compression is enabled, an attacker with access to a shared Secure Shell (SSH) connection can exploit the compression state shared across multiplexed channels. By analyzing changes in transmitted packet lengths caused by repeated data patterns, the attacker may deduce and recover sensitive plaintext information transmitted over concurrent channels in the same session.
Statement
A low severity information disclosure flaw was found in OpenSSH as included in Red Hat Hardened Images, where the openssh component is affected and a fix is being pursued through the product's delegated update process. When session compression is enabled, the LZ77 dictionary compression state is shared across all channels multiplexed over a single SSH connection. An attacker with the ability to send data over one channel of such a shared connection can perform a chosen-plaintext attack: because LZ77 replaces repeated strings with back-references into the shared search buffer, attacker-controlled input reflects measurably into the length of transmitted packets, allowing sensitive plaintext sent over a concurrent channel of the same session to be deduced and partially recovered. Exploitation requires session compression (a non-default option) to be enabled and trusted and untrusted traffic to be multiplexed over the same SSH connection, which limits practical exposure. Red Hat and upstream both assess this issue as low severity (CVSS 3.1 score 3.7).
Mitigation
Session compression is not enabled by default in OpenSSH; keeping it disabled prevents this side-channel. Set 'Compression no' in sshd_config on servers and in ssh_config (or use 'ssh -o Compression=no') on clients where compression has been enabled. Avoid multiplexing trusted and untrusted traffic over a single shared SSH connection, for example via ssh connection multiplexing (ControlMaster). Where compression of transferred data is required, applying compression at the application level before data enters the SSH session is not affected by this type of attack. A fix is being pursued for the affected Red Hat Hardened Images product.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality,Access Control
Technical Impact: Read Application Data; Bypass Protection Mechanism
Attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
