CVE-2026-106582
OpenBSD OpenSSH
LOW 3.7
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Analyzed
Description
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | mitre |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · cve@mitre.org (Secondary) |
European references
- ENISA EUVD · EUVD-2026-94004
- GCVE · GCVE-0-2026-106582
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1376 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*< 10.6
Affected products
| Product | Versions |
|---|---|
| OpenBSD · OpenSSH | affected 0 < 10.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |