CVE-2026-110926— Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
发现 OpenSSH 中存在一个安全漏洞。当启用了压缩功能时，同一连接上的不同通道会共享一个 LZ77 字典。攻击者如果能在其中一个通道上写入数据，就可以通过选择明文长度的方式，从同一连接上的另一个通道中恢复出明文内容。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1498 · Network Denial of ServiceAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | 10.5p1-1.2.hum1< * |
unaffected |
any |
unaffected | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110926
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过差异性导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 10.5p1-1.2.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-110926
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110926
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-110926 (3)
Same Patch Batch · Red Hat · 2026-10-15 · 10 CVEs total
| CVE-2026-85634 | 8.8 HIGH | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in |
| CVE-2026-92982 | 8.5 HIGH | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te |
| CVE-2026-108334 | 7.4 HIGH | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope |
| CVE-2026-84823 | 7.1 HIGH | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configurat |
| CVE-2026-110923 | 6.5 MEDIUM | Openssh: openssh: sftp can write outside the destination directory from a server-supplied |
| CVE-2026-109131 | 5.4 MEDIUM | Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu |
| CVE-2026-110925 | 5.4 MEDIUM | Openssh: openssh: '$' and '\' in a command-line username expand through %u |
| CVE-2026-110924 | 4.8 MEDIUM | Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication |
| CVE-2026-110927 | 4.3 MEDIUM | Openssh: openssh: a compressed payload can expand past the maximum packet size |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-110927
Openssh: openssh: a compressed payload can expand past the m -
CVE-2026-110925
Openssh: openssh: '$' and '\' in a command-line username exp -
CVE-2026-110923
Openssh: openssh: sftp can write outside the destination dir -
CVE-2026-88842
Busybox: busybox: dpkg stale field_start pointer causes out- -
CVE-2026-88829
Busybox: busybox: http request smuggling via pipelined reque
Same vendor: Red Hat
-
CVE-2026-84823
Org.wildfly.core: wildfly: path traversal in take-snapshot d -
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url -
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github. -
CVE-2026-85634
Wildfly-core: wildfly-core: deployer rbac role privilege esc -
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrar
Same weakness: CWE-203
-
CVE-2026-110141
Chrome <155.0.8059.79跨域数据泄露漏洞 -
CVE-2026-97788
Active Directory Federation Services (AD FS) Information Dis -
CVE-2026-97782
Microsoft Office SharePoint Tampering Vulnerability -
CVE-2026-88834
Busybox: busybox: httpd user existence oracle in non-default -
CVE-2026-109337
SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELE
V. Comments for CVE-2026-110926
No comments yet