CVE-2026-110926: 
OpenSSH 脆弱性分析と緩和策

CVE-2026-110926 is a compression-based information disclosure vulnerability in OpenSSH, where channels on the same SSH connection share a single LZ77 compression dictionary. An authenticated peer who can write on one channel can recover plaintext from another channel by observing ciphertext lengths — a technique described in the research paper "Crossing the Streams" by Fabian Bäumer and Marcus Brinkmann (2026). Affected products include OpenSSH as shipped by Red Hat (Red Hat Enterprise Linux, OpenShift RHEL CoreOS 8 and 9), though specific upstream version ranges have not yet been enumerated. The vulnerability was published on October 15, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-203 (Observable Discrepancy): OpenSSH's outbound compression was initialized with deflateInit at the default compression level, causing all channels on a single connection to share one LZ77 search buffer. An attacker with write access to one channel can craft chosen-plaintext inputs and observe resulting ciphertext length variations to infer plaintext content from a co-located channel — a side-channel attack. The fix switches outbound compression to Z_HUFFMAN_ONLY, which disables LZ77 back-reference matching and eliminates the shared dictionary, at the cost of reduced compression efficiency. Exploitation requires that SSH compression be negotiated; by default, the OpenSSH client does not offer compression, limiting exposure to explicitly configured deployments (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation results in a high confidentiality impact — an authenticated attacker can recover plaintext data transmitted on other channels of the same SSH connection, potentially including sensitive session data or credentials. There is no integrity or availability impact. The attack is limited to the scope of a single SSH connection and does not directly enable lateral movement, but recovered credentials or session tokens could facilitate further access (Red Hat Advisory, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (an authenticated SSH session) and high attack complexity, as the attacker must control one channel and perform a chosen-plaintext length analysis attack (Red Hat Advisory, GitHub Advisory).

The primary mitigation is to disable SSH compression, which is already the default for OpenSSH clients (Compression no). Administrators should verify that neither client nor server configurations explicitly enable compression. Red Hat's recommended fix switches outbound compression to Z_HUFFMAN_ONLY to eliminate the shared LZ77 dictionary; users should apply vendor patches when released for their specific Red Hat product. As an interim workaround, prefer application-level compression over SSH-layer compression (Red Hat Advisory, Red Hat Bugzilla).

Red Hat credited researchers Fabian Bäumer and Marcus Brinkmann for discovering and reporting the issue, referencing their 2026 paper "Crossing the Streams" as the technical basis for the attack. The vulnerability was filed as a medium-severity bug in Red Hat Bugzilla and is currently in NEW status, with 18 CC'd users indicating active internal triage (Red Hat Bugzilla, Red Hat Advisory).