CVE-2026-106582: OpenSSH Information Disclosure Vulnerability

CVE-2026-106582 Overview

CVE-2026-106582 affects OpenSSH versions prior to 10.6. The vulnerability exists in both the sshd server and ssh client components. These components can use an LZ77 dictionary coder even though this configuration is contraindicated by the arXiv research paper 2609.07709, "Crossing the Streams."

The issue is classified under [CWE-514] (Covert Channel). An attacker on the network could potentially infer limited information from compressed SSH streams. Exploitation requires high attack complexity and does not impact integrity or availability.

Critical Impact
Network-adjacent attackers may extract low-sensitivity information from SSH sessions by exploiting weaknesses in the LZ77 dictionary coder behavior.

Affected Products

OpenSSH sshd server before version 10.6
OpenSSH ssh client before version 10.6
Systems using OpenSSH with the LZ77 dictionary coder enabled

Discovery Timeline

2026-10-06 - CVE-2026-106582 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-106582

Vulnerability Analysis

The vulnerability resides in OpenSSH's compression handling. Both sshd and ssh can negotiate and use an LZ77 dictionary coder during an SSH session. The arXiv paper 2609.07709, "Crossing the Streams," previously demonstrated that this coder leaks information when applied to adjacent compressed data streams.

Despite that research, OpenSSH versions before 10.6 continued to permit the coder's use. An attacker observing network traffic can leverage the identified compression side channel to infer small amounts of plaintext content. The attack requires precise conditions, limiting practical exploitation to adversaries with network observation capability and specific timing opportunities.

Root Cause

The root cause is a design-level failure to deprecate a compression algorithm whose security weaknesses were already documented. OpenSSH's protocol negotiation allowed the LZ77 dictionary coder path despite peer-reviewed findings showing covert-channel leakage. The vulnerability aligns with [CWE-514], reflecting the presence of a covert channel in a security-sensitive protocol.

Attack Vector

An attacker must observe SSH traffic between a client and server that negotiated the LZ77 dictionary coder. By analyzing compressed stream characteristics, the attacker can infer limited information about session content. No authentication or user interaction is required, but the attack complexity is high due to the specific protocol and timing conditions needed. Confidentiality impact is low; integrity and availability are not affected.

See the ArXiv Research Paper for the theoretical basis of the compression side channel and the OpenSSH Release Notes 10.6 for the vendor fix.

Detection Methods for CVE-2026-106582

Indicators of Compromise

SSH session negotiations that successfully agree on LZ77-based compression algorithms with pre-10.6 OpenSSH endpoints.
Unusual volumes of short-lived SSH sessions from a single network vantage point, consistent with traffic observation attempts.
Presence of sshd or ssh binaries reporting versions earlier than 10.6 on inventory scans.

Detection Strategies

Enumerate OpenSSH versions across the environment using configuration management or vulnerability scanners to identify instances below 10.6.
Inspect SSH negotiation logs for compression algorithm selection and flag sessions using dictionary-based coders.
Correlate network traffic metadata with SSH endpoint versions to identify at-risk sessions.

Monitoring Recommendations

Monitor sshd configuration changes and track any enabling of compression on externally reachable hosts.
Alert on authentication from unexpected sources that coincide with long-lived or compression-enabled SSH sessions.
Audit SSH server banners periodically to confirm patched versions remain in place.

How to Mitigate CVE-2026-106582

Immediate Actions Required

Upgrade all OpenSSH sshd and ssh installations to version 10.6 or later.
Inventory systems to identify pre-10.6 OpenSSH deployments across servers, workstations, and embedded devices.
Disable SSH compression where it is not operationally required until patching completes.

Patch Information

OpenSSH 10.6 resolves CVE-2026-106582 by addressing the use of the LZ77 dictionary coder. Administrators should review the OpenSSH Release Notes 10.6 for the full set of changes and apply the update through their operating system package manager or by compiling from source.

Workarounds

Set Compression no in sshd_config on servers that cannot be immediately upgraded.
Set Compression no in ssh_config or user-level ~/.ssh/config to prevent clients from negotiating affected compression.
Restrict SSH access to trusted networks using firewall rules or jump hosts to reduce exposure to traffic observers.

bash

# Configuration example
# /etc/ssh/sshd_config - disable compression as a mitigation
Compression no

# /etc/ssh/ssh_config - prevent client-side negotiation
Host *
    Compression no

# Verify installed OpenSSH version
ssh -V