CVE-2026-106582 Other in OpenSSH

Low 3.7 Published 6 Oct 2026 Updated 7 Oct 2026

OpenSSH allows use of a contraindicated LZ77 dictionary coder, potentially bypassing security expectations defined in recent research.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-106582?

CVE-2026-106582 is a low-severity vulnerability in OpenSSH, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

Weakness: CWE-514

Which versions are affected by CVE-2026-106582?

It affects 1 product.

Products include OpenSSH.

How do I fix CVE-2026-106582?

Upgrade to a fixed version.

Is CVE-2026-106582 being exploited?

There is no known exploitation of CVE-2026-106582 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as AZL-106694, BELL-CVE-2026-106582, CVE-2026-110926, DEBIAN-CVE-2026-106582, ECHO-4f26-2783-85f4, GHSA-9xxf-58mh-q784 and 1 more.