CVE-2026-110927: 
OpenSSH vulnerability analysis and mitigation

CVE-2026-110927 is a Denial of Service vulnerability in OpenSSH caused by unbounded memory growth during decompression of SSH packets. After compression is negotiated, the uncompress_buffer function's inflate loop does not enforce the maximum supported packet size (PACKET_MAX_SIZE), allowing a compressed payload to expand indefinitely and causing memory consumption to grow in the process handling that connection. The vulnerability was disclosed on October 15, 2026, and affects OpenSSH as shipped in Red Hat products (including RHEL and OpenShift Container Platform); the fixed version is openssh-10.5p1-1.2.hum1. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Specifically, the uncompress_buffer function in OpenSSH's packet handling code contains an inflate loop that continues expanding the output buffer without checking against PACKET_MAX_SIZE, allowing a crafted compressed payload to cause unbounded memory growth. The fix returns SSH_ERR_INVALID_FORMAT once the buffer reaches the maximum packet size limit. Exploitation requires that SSH compression has been negotiated between client and server — the client default is compression disabled, so the flaw is only triggered in configurations where compression is explicitly enabled. This vulnerability is distinct from the separately reported LZ77 cross-channel dictionary leak (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation results in excessive memory consumption within the SSH process handling the affected connection, potentially leading to service degradation or a crash of the SSH daemon for that connection. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not constitute a memory corruption flaw. Lateral movement or data exfiltration are not directly enabled by this vulnerability (Red Hat CVE, GitHub Advisory).

Exploitation requires a low-privileged, authenticated network user — the attacker must first establish an SSH session with compression negotiated. There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (Red Hat CVE, GitHub Advisory).

Red Hat has released a patched package — openssh-10.5p1-1.2.hum1 — as part of security advisory RHSA-2026:82247 for Red Hat Hardened Images (aarch64, s390x, x86_64). The primary workaround is to leave SSH compression disabled, which is already the default client configuration; administrators should ensure Compression no is set in sshd_config on servers where compression is not required. Additionally, implementing connection limits or memory resource constraints at the system level can reduce the impact of exploitation attempts (Red Hat Errata, Red Hat CVE).

Red Hat credited Oleh Konko (1seal) with discovering and reporting the vulnerability. Red Hat's advisory explicitly notes that this flaw is separate from the LZ77 cross-channel dictionary leak, clarifying the scope for administrators who may conflate the two OpenSSH compression-related issues disclosed around the same period (Red Hat CVE).