CVE-2026-106585

A flaw was found in OpenSSH. A remote attacker can trigger a denial of service (DoS) or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet length limits, allowing oversized packets to be processed.

A flaw of moderate impact was found in OpenSSH, where the sshd server and ssh client do not verify that decompressed payloads remain within the maximum supported packet length when processing highly compressed data. A remote attacker who requires no privileges or user interaction could send crafted, highly compressed data to a vulnerable client or server, causing oversized decompressed packets to be processed, which can result in a denial of service or abnormal packet processing. Within Red Hat's portfolio, the openssh component shipped in the Red Hat Hardened Images (Hummingbird) offering is affected, and a fix is being pursued through the delegated maintenance process for that product. Red Hat rates this flaw Moderate severity with a CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), consistent with the upstream severity rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.