EUVD-2026-94004
GHSA-9xxf-58mh-q784
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote side channel observable without auth (AV:N/PR:N), but requires compression enabled plus repeated observation from a privileged position (AC:H); leaks only limited data (C:L, I:N, A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
AnalysisAI
The sshd and ssh components of OpenSSH before 10.6 can be made to negotiate and use the LZ77 dictionary-coder compression scheme, a behavior the 'Crossing the Streams' research (arXiv 2609.07709) identifies as contraindicated because compression-derived information leakage can be measured from an observed session. A remote, unauthenticated attacker who can observe and influence the target connection and repeatedly sample it may recover a limited amount of confidential data, but only where the vulnerable compression mode is actually in use; integrity and availability are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the LZ77 dictionary-coder compression feature actually be in use on the SSH connection - the description frames the flaw as this coder 'being used even though contraindicated,' so a deployment that does not negotiate/enable this compression is not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity, low-priority issue despite being network-reachable and unauthenticated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: OpenSSH 10.6 - upgrade sshd and ssh clients to 10.6 or later as documented in the official release notes (https://www.openssh.org/releasenotes.html#10.6), and track the corresponding package update from your operating-system vendor since distro-supplied builds lag upstream. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same weakness CWE-514 – Covert Channel
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today