CVE-2026-106582

Published: Oct 6, 2026Modified: Oct 13, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: MITRE (Secondary)

Description

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

Affected (1)

Products: Openbsd: Openssh

Openbsd

1 product

Openssh

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	version < 10.6

Related CWEs

CWE-514

Covert Channel

A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

References (2)

https://arxiv.org/abs/2609.07709

Source: cve@mitre.org

Third Party Advisory

https://www.openssh.org/releasenotes.html#10.6

Source: cve@mitre.org

Release Notes

Timeline

No history available yet.