CVE-2026-106585
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is…
- Risk score
- 51/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
- Affected
- OpenSSH before 10.6
- Fix
- Upgrade OpenSSH to 10.6 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: openssh
References
Original description
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Last activity 6 Oct 2026. Patch Forecast updates every hour.