medium CVSS 6.5 EPSS 0.19%

CVE-2026-106585·OpenSSH vulnerability

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

Severity
medium
Software
OpenSSH
Fixed in
10.6
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.19% — higher than 8% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 10.6

Fixed in: 10.6

How to fix this CVE

Upgrade OpenSSH to version 10.6 or later to fix a decompression validation flaw that could allow an unauthenticated attacker to cause a denial-of-service condition or integrity compromise. This vulnerability affects the SSH daemon's handling of compressed data streams, where missing packet length validation during decompression could be exploited to disrupt service or corrupt data. Apply the update immediately across all servers running OpenSSH versions before 10.6.

sudo dnf update openssh-server openssh-clients

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'ssh -V' or 'sshd -V' to check the installed OpenSSH version; any version below 10.6 is vulnerable
  2. Verify sshd is running and listening on port 22 with 'sudo systemctl status ssh' (Ubuntu/Debian) or 'sudo systemctl status sshd' (RHEL/CentOS/Amazon Linux)
  3. Search SSH daemon logs for decompression-related errors with 'sudo grep -i "decompress\|packet" /var/log/auth.log' (Ubuntu/Debian) or '/var/log/secure' (RHEL/CentOS/Amazon Linux)
  4. After patching, re-run 'ssh -V' or 'sshd -V' to confirm version 10.6 or later is installed, then restart the SSH service with 'sudo systemctl restart ssh' (Ubuntu/Debian) or 'sudo systemctl restart sshd' (RHEL/CentOS/Amazon Linux)

FAQ

What is CVE-2026-106585?

This vulnerability is a missing input validation flaw in OpenSSH's decompression routines that fails to enforce maximum packet length limits when processing highly compressed SSH data. An attacker could exploit this to trigger a denial-of-service or potentially corrupt the integrity of compressed data streams.

Is CVE-2026-106585 being actively exploited?

No, there are no confirmed active exploits or public proof-of-concept code for this vulnerability. However, it should still be patched promptly due to its medium severity and potential impact on availability and data integrity.

What versions of OpenSSH are affected by CVE-2026-106585?

All versions of OpenSSH before 10.6 are vulnerable. Version 10.6 and later include the necessary validation checks for packet length during decompression.

How do I check if my server is vulnerable to CVE-2026-106585?

Run 'ssh -V' to display the client version or 'sshd -V' for the server version. If the version number is below 10.6, the system is vulnerable and requires an immediate upgrade.

Does Defensia detect CVE-2026-106585?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2026-106585 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-106585. Free for 1 server.

Get started free