CVE-2026-106582

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

CVSS 3.1

3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-514

Published

2026-10-06

Modified

2026-10-13

Record from

the NVD, synced 2026-10-19

Affected

• openbsd:openssh

References

• https://arxiv.org/abs/2609.07709
• https://www.openssh.org/releasenotes.html#10.6

Check your stackJSON