EUVD-2026-102055
GHSA-hq2f-vwrj-48j9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate SSH session with valid credentials
-
ExploitNegotiate compression on the connection
-
ExecutionSend crafted payload inflating past max packet size
-
ImpactDrive unbounded memory growth, denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that SSH compression be negotiated on the connection (the flaw is in the inflate/decompression loop that fails to stop at the maximum supported packet size); if compression is not negotiated, the vulnerable code path is not reached. Per the CVSS vector (PR:L), an authenticated SSH session is required, which is consistent with OpenSSH's default delayed-compression behavior (zlib@openssh.com activates only after authentication). Limiting factors: the attacker needs valid credentials or an otherwise authenticated channel, impact is confined to availability (memory exhaustion of the per-connection process) with no code execution or data exposure, and servers that disable compression are not exposed. Affected scope per available data is Red Hat Enterprise Linux 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. |
| Impact | This is a genuine but modest-priority issue: a memory-exhaustion denial-of-service in OpenSSH (CWE-770, allocation of resources without limits). The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) is internally consistent with the description - network-reachable, low complexity, but requiring low-level privileges (PR:L, i.e. an authenticated SSH session) and causing only limited availability impact with no confidentiality or integrity loss. The signals do not conflict: there is no EPSS score provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The combination of authentication requirement, availability-only impact, and absence of exploitation evidence places this well below critical remote-code-execution OpenSSH flaws. The main caveat is scope of affected versions: the only sources are Red Hat (advisory and Bugzilla), so upstream OpenSSH affected-version confirmation is not present in the provided data and should be verified against the OpenSSH project and the Red Hat erratum. |
| Exploit ScenarioDerived | An authenticated user (or an attacker with valid or compromised SSH credentials) establishes an SSH session to an OpenSSH server and negotiates compression, then sends a specially crafted compressed payload that inflates beyond the maximum supported packet size. Because the inflate loop does not stop at that limit, memory consumed by the connection-handling process grows, degrading or exhausting server memory. No public exploit code is identified at time of analysis, and exploitation requires an authenticated session (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Memory exhaustion in OpenSSH's transport-layer decompression path allows an authenticated remote user to grow the memory footprint of the per-connection process by sending a compressed payload that inflates beyond the maximum supported packet size (CVE-2026-110927, CVSS 4.3). The flaw is only reachable when SSH compression has been negotiated on the connection, and per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) a valid, authenticated session is required, matching OpenSSH's default delayed-compression behaviour in which zlib activates only after authentication. Impact is confined to availability - memory growth in the handling process with no code execution, integrity, or confidentiality effect - and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV; affected scope per available vendor data is Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images.
RemediationAI
No vendor-released patch was identified at time of analysis; Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-110927 and the tracking Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2553037 should be monitored for errata and updated OpenSSH packages across RHEL 6-10, OpenShift Container Platform 4, and Hardened Images, after which systems should be patched and images rebuilt. Until then, the most direct compensating control is to disable SSH compression so the vulnerable inflate path is never negotiated - set 'Compression no' in sshd_config (and correspondingly on clients), accepting that this removes compression benefits on bandwidth-constrained links and does not help if users connect with a client that requests compression against a permissive server configuration. Because exploitation requires an authenticated session (PR:L), restrict SSH access to trusted accounts and networks, enforce key-based authentication, and remove or lock unused accounts to shrink the pool of potential attackers. Additionally, cap the blast radius of per-connection memory growth with cgroup/systemd resource limits on the sshd service (for example MemoryMax/MemoryHigh and MemoryAccounting), and lower MaxStartups so a small number of abusive connections cannot exhaust host memory; be aware that aggressive memory limits can cause legitimate sshd processes to be killed under load. Monitor per-connection sshd RSS and log anomalous decompression-driven growth to detect attempted abuse, and consider network-level rate limiting or session timeouts for untrusted clients.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenSSH implements optional payload compression as part of the SSH transport layer, negotiated during key exchange. When compression is active, incoming packets are passed through an inflate/decompression routine that reconstructs the original plaintext from a compressed payload. The defect is a resource-management flaw of class CWE-770 (Allocation of Resources Without Limits or Throttling): after decompression begins, the inflate loop does not terminate when the expanded output would exceed the protocol's maximum supported packet size, so an attacker-controlled compressed stream can expand past that ceiling and cause the process handling the connection to allocate progressively more memory. Because OpenSSH's default delayed-compression scheme (zlib@openssh.com) only enables compression after authentication, the CVSS PR:L (authenticated) rating is consistent with default deployments; a pre-authentication-only compression configuration would widen the reachable attack surface. The supplied CPE data identifies the affected packaging as Red Hat's OpenSSH builds shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images, indicating that the same upstream transport-layer code is carried across Red Hat's long-lived enterprise and container image streams.
Know when Openssh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable and low-complexity, but requires an authenticated session for compression (PR:L) per OpenSSH delayed compression; impact is availability-only memory exhaustion, so C:N/I:N/A:L.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-T
Exploit-DB