CVE-2026-110927— Openssh: openssh: a compressed payload can expand past the maximum packet size
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OpenSSH 中发现了一个漏洞。在协商使用压缩后，由于 inflate 循环未在最大支持的数据包大小处停止，压缩数据负载可能会超出该限制进行膨胀。在此过程中，处理该连接的进程内存使用量会持续增长。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | 10.5p1-1.2.hum1< * |
unaffected |
any |
unaffected | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110927
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openssh: openssh: a compressed payload can expand past the maximum packet size
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 10.5p1-1.2.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-110927
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110927
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-110927 (3)
-
-
🔗 2553037 – (CVE-2026-110927) CVE-2026-110927 openssh: openssh: a compressed payload can expand past the maximum packet size issue-tracking x_refsource_REDHAT
-
Same Patch Batch · Red Hat · 2026-10-15 · 10 CVEs total
| CVE-2026-85634 | 8.8 HIGH | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in |
| CVE-2026-92982 | 8.5 HIGH | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te |
| CVE-2026-108334 | 7.4 HIGH | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope |
| CVE-2026-84823 | 7.1 HIGH | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configurat |
| CVE-2026-110923 | 6.5 MEDIUM | Openssh: openssh: sftp can write outside the destination directory from a server-supplied |
| CVE-2026-109131 | 5.4 MEDIUM | Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu |
| CVE-2026-110925 | 5.4 MEDIUM | Openssh: openssh: '$' and '\' in a command-line username expand through %u |
| CVE-2026-110926 | 5.3 MEDIUM | Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels |
| CVE-2026-110924 | 4.8 MEDIUM | Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-110926
Openssh: openssh: shared lz77 compression dictionary leaks p -
CVE-2026-110925
Openssh: openssh: '$' and '\' in a command-line username exp -
CVE-2026-110923
Openssh: openssh: sftp can write outside the destination dir -
CVE-2026-88842
Busybox: busybox: dpkg stale field_start pointer causes out- -
CVE-2026-88829
Busybox: busybox: http request smuggling via pipelined reque
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same weakness: CWE-770
-
CVE-2026-110752
Text::CSV_XS versions before 1.65 for Perl allow memory exha -
CVE-2026-85231
Libtirpc: libtirpc: denial of service via unbounded memory a -
CVE-2026-57487
libupnp chunked HTTP bodies can bypass g_maxContentLength an -
CVE-2026-95859
libp2p-rust: Gossipsub GRAFT topics unbounded growth -
CVE-2026-107564
gocsaf/csaf: csaf_provider prone to uncontrolled resource co
V. Comments for CVE-2026-110927
No comments yet