CVE-2026-23943: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-23943 is a compression bomb (Improper Handling of Highly Compressed Data) vulnerability in the Erlang OTP SSH transport layer (ssh_transport module) that allows Denial of Service via memory exhaustion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion. Affected versions span Erlang/OTP 17.0 through 28.x (specifically before 28.4.1, 27.3.4.9, and 26.2.5.18), corresponding to the ssh application versions 3.0.1 through 5.5.1, 5.2.11.6, and 5.1.4.14. The vulnerability was published on March 13, 2026, and was discovered by Igor Morgenstern at Aisle Research. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Microsoft MSRC).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). The vulnerable code resides in lib/ssh/src/ssh_transport.erl, specifically in the ssh_transport:decompress/2 and ssh_transport:handle_packet_part/4 routines, which called zlib:inflate/2 without any decompression size limit (GitHub Advisory). Two compression algorithms are affected: zlib, which activates immediately after key exchange enabling unauthenticated attacks, and zlib@openssh.com, which activates post-authentication. Each SSH packet can decompress approximately 255 MB from 256 KB of wire data, achieving a 1029:1 amplification ratio using highly repetitive data (e.g., sequences of zeros). The fix replaces the unbounded zlib:inflate/2 call with a safe loop using zlib:safeInflate/2 that enforces a decompression size cap aligned with SSH_MAX_PACKET_SIZE, and disables zlib from the default algorithm list (OTP Commit maint-27, OTP Commit maint-26).

Successful exploitation causes memory exhaustion on the target SSH server or client, potentially triggering out-of-memory (OOM) kills and rendering the SSH service unavailable. With the default configuration (parallel_login=false), an attack can consume several hundred megabytes of memory; with parallel_login=true, consumption can reach multiple gigabytes. The impact is limited to availability — there is no confidentiality or integrity impact — but in memory-constrained environments (e.g., embedded systems, containers), the attack can cause complete service crashes (GitHub Advisory). Both SSH servers and SSH clients are affected: servers are vulnerable to unauthenticated attacks via zlib, while clients can be attacked by malicious servers.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated attack vector via zlib (no credentials required, no user interaction) makes it straightforward to exploit against any exposed Erlang SSH server running a vulnerable version with zlib compression enabled.

1. Reconnaissance: Identify internet-facing Erlang OTP SSH servers running vulnerable versions (OTP 17.0 through 28.4.1/27.3.4.9/26.2.5.18) using tools like Shodan or Censys, filtering for SSH banners indicating Erlang/OTP.
2. Initiate SSH connection: Connect to the target SSH server on port 22 (or configured SSH port) and negotiate the SSH key exchange.
3. Negotiate zlib compression: During algorithm negotiation, propose zlib as the compression algorithm. Since vulnerable versions advertise zlib by default, the server will accept it. The zlib algorithm activates immediately after key exchange, before authentication.
4. Craft compression bomb payload: Construct SSH packets containing highly compressed data (e.g., large sequences of repeated zeros compressed with zlib), achieving approximately 256 KB of wire data that decompresses to ~255 MB.
5. Send multiple packets: Transmit multiple such packets in rapid succession within a single connection or across multiple connections (especially effective when parallel_login=true), causing the server's memory to be exhausted.
6. Trigger OOM kill: The server's memory is depleted, causing the operating system to OOM-kill the SSH daemon process, resulting in denial of service (GitHub Advisory).

• Network: Unusual volume of SSH connection attempts from a single or small set of source IPs; SSH sessions that terminate abnormally shortly after key exchange without completing authentication.
• Logs: SSH daemon logs showing repeated connections that disconnect with protocol errors or without completing authentication; system logs (/var/log/syslog, dmesg) showing OOM killer events targeting the Erlang/SSH process (e.g., Out of memory: Kill process <pid> (beam.smp)).
• Process: Sudden spike in memory consumption by the beam.smp (Erlang VM) process visible via top or ps; unexpected termination and restart of the Erlang SSH application.
• System: Kernel OOM kill events in system logs; increased swap usage or memory pressure metrics coinciding with SSH connection spikes.

Upgrade to patched Erlang/OTP versions: 28.4.1, 27.3.4.9, or 26.2.5.18 (corresponding SSH library versions 5.5.1, 5.2.11.6, or 5.1.4.14 respectively). The patches disable zlib from the default compression algorithm list and enforce a decompression size limit using zlib:safeInflate/2 (OTP Commit maint-28, OTP Commit maint-26). For systems that cannot be immediately upgraded, apply the following workarounds:

• Best workaround — Disable all compression: {preferred_algorithms, [{compression, ['none']}]}
• Alternative — Remove only pre-auth zlib: {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}
• Reduce attack surface — Limit concurrent sessions: {max_sessions, N} (cap total concurrent sessions)

Additionally, implement network-level rate limiting on SSH connections and monitor system memory usage for anomalies (GitHub Advisory).

The vulnerability was responsibly disclosed by Igor Morgenstern at Aisle Research to the Erlang/OTP project, which coordinated patched releases across three active OTP branches simultaneously (GitHub Advisory). Patch announcements were posted to the Erlang Forums and Elixir Forum communities for OTP 28.4.1, 27.3.4.9, and 26.2.5.18. Downstream vendors including IBM (PowerVC), Microsoft (Azure Linux), Red Hat, SUSE, Debian, and openSUSE have issued their own security advisories and updated packages. The IBM security bulletin specifically addresses the impact on PowerVC (IBM Advisory).