CVE Feed

    Dashboard / CVE / CVE-2026-106585

    CVE-2026-106585

    In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

    Published:Oct 6, 2026
    Last Modified:Oct 15, 2026
    EPS:Oct 6, 2026
    EPSS Score:0.00189
    CVSS Score:6.5

    Affected Products

    Vendor
    Openbsd
    Product
    Openssh

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-106583 (CVSS 2.5) — In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.…
    CVE-2026-106589 (CVSS 2.9) — In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can …
    CVE-2026-106588 (CVSS 3.1) — In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing,…
    CVE-2026-106587 (CVSS 3.6) — In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a file…
    CVE-2026-106586 (CVSS 2.5) — In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tun…
    CVE-2026-106584 (CVSS 2.5) — In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight S…
    CVE-2026-106582 (CVSS 3.7) — In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicat…
    CVE-2026-106555 (CVSS 2.2) — In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across …
    CVE-2026-106553 (CVSS 2.2) — In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication au…
    CVE-2026-106552 (CVSS 4.2) — In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unint…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High