CVE-2026-110927

openssh: openssh: a compressed payload can expand past the maximum packet size

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · October 15, 2026

Updated · November 4, 2026

Description

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.

Statement

Status: REJECTED

Reason: Duplicate

CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-770 · Allocation of Resources Without Limits or Throttling