OpenSSH CVE-2026-110926

Requires that SSH compression be negotiated on the connection (e.g., Compression enabled / zlib or zlib@openssh.com) AND that two or more channels be multiplexed over the same SSH connection so they share one LZ77 dictionary; the attacker must be an authenticated peer (PR:L) able to write chosen data on one channel while a victim's sensitive data traverses another. Exploitation is LIMITED by: authentication being required, high attack complexity (statistical chosen-plaintext length analysis, AC:H), the non-default nature of compression in many hardened OpenSSH configurations, and the need for a genuinely shared/multiplexed connection with attacker-controlled and victim channels co-resident.

This is a medium-severity information-disclosure side channel (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) in OpenSSH's compression handling, where channels sharing one LZ77 dictionary leak plaintext across channels via chosen-plaintext length analysis. The signals are internally consistent and point to LOW real-world urgency despite the high confidentiality impact: the vector requires authentication (PR:L) and carries high attack complexity (AC:H) reflecting the chosen-plaintext/compression-oracle technique and the prerequisite that compression be negotiated and multiple channels be multiplexed on one connection. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - all three exploitation-pressure signals are absent, so there is no evidence of active or imminent exploitation. No signals conflict; rather, the high C impact is tempered by AC:H and PR:L, making this a 'high-impact-but-hard-to-exploit' issue rather than an emergency. Prioritize for routine patching on multi-tenant/jump-host systems where untrusted users share SSH connections; it is not a drop-everything item. Note the only sources are a Red Hat advisory and Bugzilla - upstream OpenSSH confirmation of affected versions and fix is not included in this data and should be verified.

On a shared SSH deployment (e.g., a bastion or multiplexed connection) with compression negotiated, an authenticated attacker who controls data written to one channel observes compressed-output length variations to infer plaintext carried on a co-resident channel sharing the same LZ77 dictionary. By submitting chosen plaintext and measuring resulting length changes, they progressively recover secret bytes from the victim channel. No public exploit code is identified at time of analysis, and the AC:H rating reflects the statistical, chosen-plaintext effort required.