{"id":"CVE-2026-106582","aliases":["AZL-106694","BELL-CVE-2026-106582","CLSA-2026-1792513900","DEBIAN-CVE-2026-106582","EUVD-2026-94004","GHSA-9xxf-58mh-q784","MGASA-2026-0521","RHSA-2026:82247","UBUNTU-CVE-2026-106582","USN-8928-1","USN-8937-1"],"status":"published","title":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is...","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00183,"percentile":0.07929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-514"],"published":"2026-10-06T20:35:32Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpaquita:23","package":"openssh","fixed_in":["9.1_p1-r16"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssh","fixed_in":["10.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssh","fixed_in":["10.6_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssh","fixed_in":["9.1_p1-r16"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssh","fixed_in":["10.6_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","fixed_in":["10.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:10.6p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh-gssapi","fixed_in":["1:10.6p1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssh","fixed_in":["1:8.9p1-3ubuntu0.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssh","fixed_in":["1:9.6p1-3ubuntu13.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"openssh","fixed_in":["1:10.5p1-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"openssh-gssapi","fixed_in":["1:10.5p1-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssh","fixed_in":["1:10.2p1-2ubuntu3.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.8p1-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r16"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"10.6_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r16"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.6_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"10.6_p1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-sk-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-5.30.el9_2.tuxcare.els25"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-1","1:10.0p1-2","1:10.0p1-3","1:10.0p1-4","1:10.0p1-5","1:10.0p1-5~bpo12+2","1:10.0p1-6","1:10.0p1-7","1:10.0p1-7~bpo12+1","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u10","1:9.2p1-2+deb12u2","1:9.2p1-2+deb12u3","1:9.2p1-2+deb12u4","1:9.2p1-2+deb12u5","1:9.2p1-2+deb12u6","1:9.2p1-2+deb12u7","1:9.2p1-2+deb12u8","1:9.2p1-2+deb12u9","1:9.3p1-1","1:9.3p1-1+loong64","1:9.3p2-1","1:9.4p1-1","1:9.5p1-1","1:9.5p1-2","1:9.6p1-1","1:9.6p1-2","1:9.6p1-3","1:9.6p1-4","1:9.6p1-5","1:9.7p1-1","1:9.7p1-2","1:9.7p1-3","1:9.7p1-3+hurd.1","1:9.7p1-4","1:9.7p1-5","1:9.7p1-6","1:9.7p1-7","1:9.8p1-1","1:9.8p1-2","1:9.8p1-3","1:9.8p1-4","1:9.8p1-7","1:9.8p1-8","1:9.9p1-1","1:9.9p1-2","1:9.9p1-3","1:9.9p1-3+hurd.1","1:9.9p2-1","1:9.9p2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-7+deb13u1","1:10.0p1-7+deb13u2","1:10.0p1-7+deb13u3","1:10.0p1-7+deb13u4","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.6p1-1"}]}],"versions":["1:10.0p1-7","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh-gssapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.6p1-1"}]}],"versions":["1:10.4p1-5","1:10.5p1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0p1-4.1.mga10"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-keysign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssh-sk-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5p1-1.2.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11","1:6.6p1-2ubuntu2.12","1:6.6p1-2ubuntu2.13","1:6.6p1-2ubuntu2.13+esm1","1:6.6p1-2ubuntu2.13+esm2","1:6.6p1-2ubuntu2.13+esm3","1:6.6p1-2ubuntu2.13+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6","1:7.2p2-4ubuntu2.7","1:7.2p2-4ubuntu2.8","1:7.2p2-4ubuntu2.10","1:7.2p2-4ubuntu2.10+esm1","1:7.2p2-4ubuntu2.10+esm2","1:7.2p2-4ubuntu2.10+esm3","1:7.2p2-4ubuntu2.10+esm4","1:7.2p2-4ubuntu2.10+esm5","1:7.2p2-4ubuntu2.10+esm6","1:7.2p2-4ubuntu2.10+esm7","1:7.2p2-4ubuntu2.10+esm8","1:7.2p2-4ubuntu2.10+esm9","1:7.2p2-4ubuntu2.10+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2.3","1:7.2p2-4ubuntu2.fips.2.4.1","1:7.2p2-4ubuntu2.fips.2.4.2","1:7.2p2-4ubuntu2.fips.2.8.1","1:7.2p2-4ubuntu2.fips.2.10.1","1:7.2p2-4ubuntu2.fips.2.10.2","1:7.2p2-4ubuntu2.fips.2.10.3","1:7.2p2-4ubuntu2.fips.2.10.4","1:7.2p2-4ubuntu2.fips.2.10.5","1:7.2p2-4ubuntu2.fips.2.10.6","1:7.2p2-4ubuntu2.fips.2.10.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2","1:7.2p2-4ubuntu2.fips.2.2.1","1:7.2p2-4ubuntu2.fips.2.10.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1","1:7.6p1-4ubuntu0.2","1:7.6p1-4ubuntu0.3","1:7.6p1-4ubuntu0.5","1:7.6p1-4ubuntu0.6","1:7.6p1-4ubuntu0.7","1:7.6p1-4ubuntu0.7+esm1","1:7.6p1-4ubuntu0.7+esm2","1:7.6p1-4ubuntu0.7+esm3","1:7.6p1-4ubuntu0.7+esm4","1:7.6p1-4ubuntu0.7+esm5","1:7.6p1-4ubuntu0.7+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.9p1-10~ubuntu18.04.fips.0.1","1:7.9p1-10~ubuntu18.04.fips.0.2","1:7.9p1-10~ubuntu18.04.fips.0.3","1:7.9p1-10~ubuntu18.04.fips.0.4","1:7.9p1-10~ubuntu18.04.fips.0.5","1:7.9p1-10~ubuntu18.04.fips.0.6","1:7.9p1-10~ubuntu18.04.fips.0.7","1:7.9p1-10~ubuntu18.04.fips.0.8","1:7.9p1-10~ubuntu18.04.fips.0.9","1:7.9p1-10~ubuntu18.04.fips.0.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.9p1-10~ubuntu18.04.fips.0.1","1:7.9p1-10~ubuntu18.04.fips.0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0p1-6build1","1:8.1p1-1","1:8.1p1-5","1:8.2p1-4","1:8.2p1-4ubuntu0.1","1:8.2p1-4ubuntu0.2","1:8.2p1-4ubuntu0.3","1:8.2p1-4ubuntu0.4","1:8.2p1-4ubuntu0.5","1:8.2p1-4ubuntu0.7","1:8.2p1-4ubuntu0.8","1:8.2p1-4ubuntu0.9","1:8.2p1-4ubuntu0.10","1:8.2p1-4ubuntu0.11","1:8.2p1-4ubuntu0.12","1:8.2p1-4ubuntu0.13","1:8.2p1-4ubuntu0.13+esm1","1:8.2p1-4ubuntu0.13+esm2","1:8.2p1-4ubuntu0.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.2p1-4ubuntu0.fips.0.2.1","1:8.2p1-4ubuntu0.fips.0.4.0","1:8.2p1-4ubuntu0.fips.0.5.0","1:8.2p1-4ubuntu0.fips.0.7","1:8.2p1-4ubuntu0.fips.0.8","1:8.2p1-4ubuntu0.fips.0.9","1:8.2p1-4ubuntu0.fips.0.10","1:8.2p1-4ubuntu0.fips.0.11","1:8.2p1-4ubuntu0.fips.0.12","1:8.2p1-4ubuntu0.fips.0.13","1:8.2p1-4ubuntu0.fips.0.13.1","1:8.2p1-4ubuntu0.fips.0.13.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.2p1-4ubuntu0.fips.0.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.18"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5","1:8.9p1-3ubuntu0.6","1:8.9p1-3ubuntu0.7","1:8.9p1-3ubuntu0.10","1:8.9p1-3ubuntu0.11","1:8.9p1-3ubuntu0.13","1:8.9p1-3ubuntu0.14","1:8.9p1-3ubuntu0.15","1:8.9p1-3ubuntu0.16","1:8.9p1-3ubuntu0.17"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.9p1-3ubuntu0.4+Fips1","1:8.9p1-3ubuntu0.4+Fips3","1:8.9p1-3ubuntu1.fips.0~ppa3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.9p1-3ubuntu0.4+Fips1","1:8.9p1-3ubuntu0.4+Fips3","1:8.9p1-3ubuntu0.6+Fips1","1:8.9p1-3ubuntu0.7+Fips1","1:8.9p1-3ubuntu0.10+Fips1","1:8.9p1-3ubuntu0.11+Fips1","1:8.9p1-3ubuntu0.13+Fips1","1:8.9p1-3ubuntu0.14+Fips1","1:8.9p1-3ubuntu0.15+Fips1","1:8.9p1-3ubuntu0.15+Fips3","1:8.9p1-3ubuntu0.16+Fips3","1:8.9p1-3ubuntu0.18+Fips1","1:8.9p1-3ubuntu1.fips.0~ppa3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.20"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13","1:9.6p1-3ubuntu13.3","1:9.6p1-3ubuntu13.4","1:9.6p1-3ubuntu13.5","1:9.6p1-3ubuntu13.7","1:9.6p1-3ubuntu13.8","1:9.6p1-3ubuntu13.9","1:9.6p1-3ubuntu13.11","1:9.6p1-3ubuntu13.12","1:9.6p1-3ubuntu13.13","1:9.6p1-3ubuntu13.14","1:9.6p1-3ubuntu13.15","1:9.6p1-3ubuntu13.16","1:9.6p1-3ubuntu13.18","1:9.6p1-3ubuntu13.19"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.6p1-3ubuntu13.7+Fips1","1:9.6p1-3ubuntu13.12+Fips1","1:9.6p1-3ubuntu13.13+Fips1","1:9.6p1-3ubuntu13.14+Fips1","1:9.6p1-3ubuntu13.15+Fips1","1:9.6p1-3ubuntu13.16+Fips1","1:9.6p1-3ubuntu13.16+Fips2","1:9.6p1-3ubuntu13.18+Fips1","1:9.6p1-3ubuntu13.19+Fips1","1:9.6p1-3ubuntu13.20+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.5p1-1ubuntu3.1"}]}],"versions":["1:10.2p1-2ubuntu3","1:10.3p1-4ubuntu1","1:10.3p1-4ubuntu2","1:10.5p1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh-gssapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.5p1-1ubuntu3.1"}]}],"versions":["1:10.5p1-1ubuntu1","1:10.5p1-1ubuntu2","1:10.5p1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-18","1:7.5p1-18ubuntu1","1:7.5p1-18ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2p1-2ubuntu3.8"}]}],"versions":["1:10.0p1-5ubuntu5","1:10.2p1-2ubuntu1","1:10.2p1-2ubuntu3","1:10.2p1-2ubuntu3.2","1:10.2p1-2ubuntu3.4","1:10.2p1-2ubuntu3.5","1:10.2p1-2ubuntu3.6","1:10.2p1-2ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-17","1:7.5p1-18"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.18"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5","1:8.9p1-3ubuntu0.6","1:8.9p1-3ubuntu0.7","1:8.9p1-3ubuntu0.10","1:8.9p1-3ubuntu0.11","1:8.9p1-3ubuntu0.13","1:8.9p1-3ubuntu0.14","1:8.9p1-3ubuntu0.15","1:8.9p1-3ubuntu0.16","1:8.9p1-3ubuntu0.17"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.20"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13","1:9.6p1-3ubuntu13.3","1:9.6p1-3ubuntu13.4","1:9.6p1-3ubuntu13.5","1:9.6p1-3ubuntu13.7","1:9.6p1-3ubuntu13.8","1:9.6p1-3ubuntu13.9","1:9.6p1-3ubuntu13.11","1:9.6p1-3ubuntu13.12","1:9.6p1-3ubuntu13.13","1:9.6p1-3ubuntu13.14","1:9.6p1-3ubuntu13.15","1:9.6p1-3ubuntu13.16","1:9.6p1-3ubuntu13.18","1:9.6p1-3ubuntu13.19"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2p1-2ubuntu3.8"}]}],"versions":["1:10.0p1-5ubuntu5","1:10.2p1-2ubuntu1","1:10.2p1-2ubuntu3","1:10.2p1-2ubuntu3.2","1:10.2p1-2ubuntu3.4","1:10.2p1-2ubuntu3.5","1:10.2p1-2ubuntu3.6","1:10.2p1-2ubuntu3.7"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.5p1-1ubuntu3.1"}]}],"versions":["1:10.2p1-2ubuntu3","1:10.3p1-4ubuntu1","1:10.3p1-4ubuntu2","1:10.5p1-1ubuntu2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh-gssapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.5p1-1ubuntu3.1"}]}],"versions":["1:10.5p1-1ubuntu1","1:10.5p1-1ubuntu2","1:10.5p1-1ubuntu3"],"bundled":9}],"products":[{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","tags":["Release Notes","web","article","report"]},{"url":"https://arxiv.org/abs/2609.07709","tags":["Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106582","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9xxf-58mh-q784"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-106582","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792513900.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106587","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106582.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-106582","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0521.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35876","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FAMKD5T6664L7TA7EBJFLZB2RX3AQYZ/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8533-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2ZK2T3OFPOIBFAZQAJISQ7EML4PHYVB/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/12/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRB2YTKIEJGFGAKEXYAPCDQSKUFBEI7B/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8721-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8928-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82247","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106586","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106583","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106587","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106552","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106582","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106584","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106585","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110925","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110923","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82247.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106552","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106582","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106583","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106584","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106585","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106585","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106586","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106587","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553028","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110923","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110925","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110926","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110927","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-106582","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8937-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-106552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-106587","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-106582","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T20:35:32.577Z","modified":"2026-10-07T14:05:31.972Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T14:20:04.463704Z"}],"euvd":[{"id":"EUVD-2026-94004","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T20:35:32Z","modified":"2026-10-07T14:05:31Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:35.509652Z"}],"ghsa":[{"id":"GHSA-9xxf-58mh-q784","title":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is...","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T21:32:04Z","modified":"2026-10-06T21:32:09Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T15:12:52.908481Z"}],"nvd":[{"id":"CVE-2026-106582","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T21:17:19.37Z","modified":"2026-10-13T14:57:12.573Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"BELL-CVE-2026-106582","status":"published","published":"2026-10-09T06:09:24.71706Z","modified":"2026-10-10T07:15:06.051328992Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-106582","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T20:35:32.577Z","modified":"2026-10-28T02:31:08.245962077Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"DEBIAN-CVE-2026-106582","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T21:17:19.37Z","modified":"2026-10-14T09:47:36.514232158Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"RHSA-2026:82247","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-14T10:32:42Z","modified":"2026-10-20T10:43:33.437440456Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-106582","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-07T00:00:00Z","modified":"2026-10-23T04:45:03.356771833Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-106694","title":"CVE-2026-106582 affecting package openssh 9.8p1-10","description":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.","status":"published","published":"2026-10-06T21:17:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"CLSA-2026-1792513900","title":"openssh: Fix of CVE-2026-106587","description":"- CVE-2026-106587: sshd did not clear AuthorizedPrincipalsFile,\n  TrustedUserCAKeys and Banner when a Match block set them to \"none\", so\n  the global value stayed in effect before authentication; clear them in\n  the pre-auth part of copy_set_server_options(). Backport upstream\n  commit 526fd277.\n- CVE-2026-106586: sshd dropped the authorized_keys \"restrict\" flag when\n  merging key and certificate options, which could re-enable features such\n  as tunnel forwarding; OR the restricted flag in sshauthopt_merge().\n  Backport upstream commit 991f1f31.\n- CVE-2026-106552: sftp(1) accepted an empty file name from a server\n  directory listing and could pick \"..\" or the local root as an implicit\n  download destination; reject empty names and map \"..\" and remote roots\n  to \".\". Backport upstream commit c07ea218.\n- CVE-2026-106584: ssh-keygen(1) converted certificate validity dates\n  without letting mktime() decide DST, giving expiry times off by an hour;\n  set tm_isdst to -1 in parse_absolute_time(). Backport upstream commit\n  aef20dfe.\n- CVE-2026-106582: compressed SSH sessions used the zlib LZ77 dictionary\n  coder, exposing a compression side channel; use Huffman-only\n  compression for outgoing packets. Backport upstream commit 1d5340fc.","status":"published","published":"2026-10-20T16:31:49Z","modified":"2026-10-26T09:43:51.84486598Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"MGASA-2026-0521","title":"Updated openssh packages fix security vulnerabilities","description":"Local mitm of x11 forwarding via abstract unix socket pre-binding in Red\nHat Enterprise Linux openssh client versions. (CVE-2026-55655)\nsftp in OpenSSH before 10.4 does not properly constrain the location of\ndownloaded files when \"sftp server:/path .\" is used with an\nattacker-controlled server. (CVE-2026-59995)\nscp in OpenSSH before 10.4 may place a file in the parent directory of\nan intended directory when the copy occurs between two remote\ndestinations. (CVE-2026-59996)\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9\ncommand-line arguments, which can be important if a later command-line\nargument would have helped to ensure the intended security properties of\nan SFTP connection. (CVE-2026-59997)\nsshd in OpenSSH before 10.4 has an undocumented security-relevant\nbehavior: GSSAPIStrictAcceptorCheck has no value if the server is in\nWindows Active Directory. (CVE-2026-59998)\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to\ntake precedence over PermitTunnel=yes, but did not. (CVE-2026-59999)\nsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of\nservice (resource consumption from excessive authentication attempts)\nbecause MaxAuthTries was mishandled for GSSAPIAuthentication.\n(CVE-2026-60000)\nsshd in OpenSSH before 10.4 does not always honor the minimum\nauthentication delay. (CVE-2026-60001)\nssh in OpenSSH before 10.4 can have a use-after-free when a server\nchanges its host key during a key re-exchange. (This outcome occurs only\non the client side.). (CVE-2026-60002)\nIn ssh-agent in OpenSSH before 10.5, some operations can occur remotely\nbut were intended to occur only locally, including operations that add\ntokens or use keys. This is caused by misinteraction between agent\nlocking and the session-bind@openssh.com extension. (CVE-2026-73281)\nIn ssh in OpenSSH before 10.5, a use-after-free for realloc data can\noccur if a certain pair of remote-forwarding operations are concurrent.\n(CVE-2026-73282)\nIn sshd in OpenSSH before 10.5, the restrict keyword (in\nauthorized_keys) was supposed to be applicable to tunnel forwarding but\nwas not. (CVE-2026-73283)\nIn sftp in OpenSSH before 10.6, a server can trigger directory traversal\n(causing files to be written to unintended locations) during a recursive\ncopy operation. (CVE-2026-106552)\nIn sshd in OpenSSH before 10.6, credentials can incorrectly persist\nafter failure of a GSSAPIAuthentication authentication attempt.\n(CVE-2026-106553)\nIn sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication\nstate can incorrectly be persisted across authentication attempts.\n(CVE-2026-106555)\nIn sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be\nused even though this is contraindicated by the arXiv 2609.07709\n\"Crossing the Streams\" findings. (CVE-2026-106582)\nIn ssh in OpenSSH before 10.6, a $ or \\ character can occur in a\ncommand-line username, leading to injection. (CVE-2026-106583)\nIn ssh-keygen in OpenSSH before 10.6, certificates could have incorrect\nexpiration times because of Daylight Saving mishandling. There can be a\nslightly more severe effect on users in certain Antarctic locations.\n(CVE-2026-106584)\nIn sshd and ssh in OpenSSH before 10.6, there is no check for whether\nthe maximum packet length is exceeded during decompression of highly\ncompressed data. (CVE-2026-106585)\nIn sshd in OpenSSH before 10.6, the restrict keyword (in\nauthorized_keys) was supposed to be applicable to tunnel forwarding but\nwas not, a different vulnerability than CVE-2026-73283.\n(CVE-2026-106586)\nIn sshd in OpenSSH before 10.6, the value \"none\" for a configuration\noption is sometimes interpreted as a filename but was intended to mean\nthat a feature is disabled. (CVE-2026-106587)\n","status":"published","published":"2026-10-19T16:59:00Z","modified":"2026-10-19T17:13:38.453313742Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8928-1","title":"openssh vulnerabilities","description":"It was discovered that OpenSSH's sftp client incorrectly handled paths\nreturned by the server during a recursive copy operation. A remote\nattacker controlling the server could possibly use this issue to write\nfiles to unintended locations. (CVE-2026-106552)\n\nIt was discovered that OpenSSH's sshd server incorrectly handled\nGSSAPIAuthentication state across authentication attempts. An attacker\ncould possibly use this issue to obtain credentials from a previous\nfailed authentication attempt. (CVE-2026-106553, CVE-2026-106555)\n\nIt was discovered that OpenSSH incorrectly used an LZ77 dictionary coder\nduring compression. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2026-106582)\n\nIt was discovered that OpenSSH's ssh client incorrectly allowed special\ncharacters in command-line usernames. An attacker could possibly use this\nissue to inject arbitrary commands via specially crafted usernames.\n(CVE-2026-106583)\n\nIt was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight\nSaving Time when converting dates. An attacker could possibly use this\nissue to cause certificates to have incorrect expiration times.\n(CVE-2026-106584)\n\nIt was discovered that OpenSSH did not check whether the maximum packet\nlength was exceeded during decompression. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2026-106585)\n\nIt was discovered that OpenSSH's sshd server incorrectly applied the\nrestrict keyword from authorized_keys to tunnel forwarding requests. A\nlocal attacker with an authorized key could possibly use this issue to\nbypass intended tunnel forwarding restrictions. (CVE-2026-106586)\n\nIt was discovered that OpenSSH's sshd server incorrectly handled certain\nconfiguration options that accept a \"none\" value. An attacker could\npossibly use this issue to cause OpenSSH to behave unexpectedly.\n(CVE-2026-106587)","status":"published","published":"2026-10-14T12:13:18Z","modified":"2026-10-17T13:11:54.038235995Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8937-1","title":"openssh, openssh-gssapi vulnerabilities","description":"It was discovered that OpenSSH's sftp client incorrectly handled paths\nreturned by the server during a recursive copy operation. A remote attacker\ncontrolling the server could possibly use this issue to write files to\nunintended locations. (CVE-2026-106552)\n\nIt was discovered that OpenSSH's sshd server incorrectly handled\nGSSAPIAuthentication state across authentication attempts. An attacker\ncould possibly use this issue to obtain credentials from a previous failed\nauthentication attempt. (CVE-2026-106553, CVE-2026-106555)\n\nIt was discovered that OpenSSH incorrectly used an LZ77 dictionary coder\nduring compression. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2026-106582)\n\nIt was discovered that OpenSSH's ssh client incorrectly allowed special\ncharacters in command-line usernames. An attacker could possibly use this\nissue to inject arbitrary commands via specially crafted usernames.\n(CVE-2026-106583)\n\nIt was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight\nSaving Time when converting dates. An attacker could possibly use this\nissue to cause certificates to have incorrect expiration times.\n(CVE-2026-106584)\n\nIt was discovered that OpenSSH did not check whether the maximum packet\nlength was exceeded during decompression. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2026-106585)\n\nIt was discovered that OpenSSH's sshd server incorrectly applied the\nrestrict keyword from authorized_keys to tunnel forwarding requests. A\nlocal attacker with an authorized key could possibly use this issue to\nbypass intended tunnel forwarding restrictions. (CVE-2026-106586)\n\nIt was discovered that OpenSSH's sshd server incorrectly handled certain\nconfiguration options that accept a \"none\" value. An attacker could\npossibly use this issue to cause OpenSSH to behave unexpectedly.\n(CVE-2026-106587)","status":"published","published":"2026-10-19T13:34:39Z","modified":"2026-10-19T23:43:21.200850366Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}