CVE-2026-110926

Executive Summary

CVE-2026-110926 is an information disclosure flaw in OpenSSH in which channels multiplexed over a single connection share one LZ77 compression dictionary. When compression is negotiated, a peer with write access to one channel can recover plaintext from another channel by observing chosen-plaintext length behavior. The vulnerability is unpatched, has no public proof-of-concept, is not listed in CISA KEV, and has not been scored by FIRST.org's EPSS.

Technical Analysis

OpenSSH multiplexes multiple logical channels over a single transport connection. When the SSH transport layer negotiates compression (historically the zlib or zlib@openssh.com methods), the compressed byte stream is produced by a single LZ77-family compressor state for the connection. That compressor maintains a shared sliding-window dictionary: substrings emitted for one channel become back-reference candidates for data compressed on any other channel in the same connection.

LZ77 compression encodes repeated data as back-references (offset, length) to a sliding window rather than re-emitting literal bytes. The size of the compressor output therefore depends on whether the input matches content already present in the dictionary. An attacker who controls the plaintext written to one channel can inject chosen substrings into the shared dictionary and then observe the resulting compressed size on the victim's channel (or a side channel derived from it). If a guessed plaintext fragment in the victim channel matches dictionary contents, the compressor emits a short back-reference; if it does not match, the fragment is emitted as literals. This length difference leaks one bit of information per probe about the victim channel's plaintext.

The vulnerability class is a cross-channel / cross-tenant compression side channel — closely related in mechanism to CRIME and BREACH, which exploit shared compression dictionaries to recover secrets. CWE-203 (Observable Discrepancy) is assigned, indicating the root issue is a measurable difference in observable output (compressed length) correlated with secret-dependent input.

Key characteristics:

• Attack vector: Network (AV:N) — reachable over any SSH transport where compression is negotiated.
• Attack complexity: High (AC:H) — recovering a full secret requires statistical aggregation of many length observations, careful control of dictionary state, and favorable traffic patterns.
• Privileges required: Low (PR:L) — the attacker must be an authenticated peer able to open and write to at least one channel on the connection.
• User interaction: None (UI:N).
• Confidentiality impact: High (C:H) — successful exploitation discloses plaintext from a channel the attacker does not own.
• Integrity/availability: None (I:N/A:N).

The shared-dictionary design assumption is that channel data is not mutually adversarial. When it is — for example, when distinct trust domains multiplex over one connection — that assumption breaks.

Exploitation Scenarios

No public PoC exists; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, paths, or parameters are asserted because none are provided in the source data.

1. Reconnaissance / target identification. The adversary identifies an SSH endpoint that negotiates compression during key exchange and that carries multiplexed channels belonging to different trust domains (e.g., a bastion or jump host aggregating sessions from multiple users or tenants). SSH banner and algorithm negotiation reveal whether compression is offered.

2. Triggering the flaw class. Once authenticated with low privileges (PR:L), the attacker opens a channel on the connection and writes controlled data, seeding the shared LZ77 dictionary with chosen plaintext. Because the dictionary is shared, those entries are then available to the compressor handling other channels.

3. Payload / probe method. The attacker issues a series of chosen-plaintext probes and measures the compressor's output size (or a proxy such as observable timing/bandwidth on the connection). Where a guessed fragment matches victim-channel plaintext, LZ77 emits a compact back-reference; otherwise the fragment is emitted as literals. The attacker iterates byte-by-byte, using the length oracle to reduce candidate plaintext.

4. Post-exploitation impact. Recovered plaintext may include credentials, session tokens, command output, or other data from the victim channel. The attacker gains channel-crossing confidentiality without writing to the victim channel or requiring user interaction. Because exploitation occurs within a legitimate, authenticated SSH session, it can be difficult to distinguish from normal activity using conventional authentication logs alone.

Impact Assessment

Successful exploitation yields high confidentiality impact (C:H) against data carried on channels sharing a connection with an attacker-controlled channel. Integrity and availability are unaffected (I:N/A:N). The CVSS base score is 5.3 (Medium), driven by network reachability and high confidentiality impact, but moderated by high attack complexity (AC:H) and the low-privilege requirement (PR:L). The elevated complexity reflects the statistical and state-control effort required to recover meaningful plaintext, and the exploit is not trivially reliable.

Blast radius is concentrated in architectures where a single SSH connection is shared across trust boundaries:

• Bastion/jump hosts and SSH multiplexing setups aggregating multiple users or sessions.
• Managed file transfer and automation platforms that pool sessions.
• Carrier-grade or embedded systems where compression over SSH is enabled by default.

In these environments, one lower-trusted peer could recover plaintext from another peer's channel, exposing credentials, tokens, or sensitive command output. Because no patch is available (patch confidence 0/4), exposure persists until configuration is hardened.

Detection Guidance

Detection of a compression length-oracle attack is inherently difficult: the malicious traffic is a legitimate, authenticated SSH session. Effective detection concentrates on configuration drift (compression unexpectedly enabled) and anomalous channel/session patterns rather than a single signature.

Sigma Rule

title: OpenSSH Compression Negotiation Observed on SSH Session
id: 7c1f0a2e-9b3d-4e21-8a55-2f6c9d0a1109
status: experimental
description: Detects SSH sessions where compression is negotiated, a prerequisite for CVE-2026-110926 cross-channel dictionary leakage.
logsource:
  product: linux
  service: sshd
detection:
  selection_compress:
    message|contains:
      - 'compression: zlib'
      - 'compression: zlib@openssh.com'
  condition: selection_compress
falsepositives:
  - Legacy clients that legitimately negotiate compression
level: medium
tags:
  - attack.t1040
  - cve.2026.110926

YARA Rule

rule CVE_2026_110926_SSH_Compression_Dictionary_Abuse
{
    meta:
        description = "Heuristic detection for tooling attempting cross-channel LZ77 dictionary probing over SSH"
        author = "Threat Intelligence"
        reference = "CVE-2026-110926"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ssh_banner = "SSH-2.0-" ascii
        $comp_a = "zlib@openssh.com" ascii
        $comp_b = "zlib" ascii
        $mux_marker = "mux" ascii nocase

    condition:
        $ssh_banner and ($comp_a or $comp_b) and $mux_marker
}

Note: This YARA rule is heuristic and targets artifacts of SSH multiplexing tooling that negotiate compression; it is not a precise signature and must be tuned to the environment to avoid false positives.

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-110926 Possible SSH Compression Dictionary Abuse - High Channel Multiplexing"; flow:established,to_server; dsize:>0; threshold:type both, track by_src, count 100, seconds 30; classtype:attempted-recon; reference:cve,2026-110926; sid:2026110926; rev:1;)

This rule flags high-rate SSH client traffic consistent with automated probing. It is a heuristic rate-based signal, not a protocol-accurate detection, and should be baselined before production use.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [network where network.transport == "tcp" and destination.port == 22 and process.name in ("ssh", "sftp")]
  [network where network.transport == "tcp" and destination.port == 22 and process.name in ("ssh", "sftp")]

This EQL sequence surfaces repeated SSH client connection activity by the same process within a short window, which may indicate automated dictionary-probing tooling. Tune thresholds to baseline.

Splunk SPL Query

index=network sourcetype=firewall dest_port=22 action=allowed
| stats count AS conns, dc(src) AS sources BY src, dest
| where conns > 200
| sort - conns
| table src dest conns sources

Anomalous, high-volume SSH connection counts to a single destination can indicate iterative probing campaigns. Adjust thresholds to the environment baseline.

Wazuh OSSEC Rule

<group name="sshd,cve-2026-110926,">
  <rule id="100926" level="7">
    <decoded_as>sshd</decoded_as>
    <match>compression</match>
    <description>CVE-2026-110926: SSH session with compression negotiated - potential shared-dictionary leakage exposure.</description>
    <mitre>
      <id>T1040</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix or workaround was identified.

1. Immediate mitigations.

   • Disable SSH compression at both client and server. On the server, set Compression no in sshd_config; on clients, avoid Compression yes / -C and disable zlib / zlib@openssh.com via Compression no or Host-scoped configuration.
   • Disable connection multiplexing (ControlMaster / ControlPersist) on clients and discourage shared-session aggregation where distinct trust domains are involved, so channels from different peers do not share one transport and one compressor state.
   • Restrict who can open channels on shared connections; enforce per-user SSH keys and privilege separation so PR:L peers cannot share a connection with higher-trust channels.

2. Patch/upgrade steps.

   • No patch is currently available. Monitor the OpenSSH project and the distribution security advisories for CVE-2026-110926. When an update is released, apply the vendor package and verify the SSH daemon version and algorithm negotiation post-upgrade.

3. Long-term hardening.

   • Establish policy that compression is disabled by default across all SSH endpoints and enforce it via configuration management.
   • Segment multiplexed sessions by trust domain; avoid single connections that mix users of different privilege tiers.
   • Deploy the detection content above to alert on compression negotiation and anomalous multiplexing, and review channel-sharing architecture for latent cross-tenant exposure.

References

1. National Vulnerability Database — CVE-2026-110926: https://nvd.nist.gov/vuln/detail/CVE-2026-110926
2. OpenSSH Project — official releases and security advisories: https://www.openssh.com/
3. CWE-203 — Observable Discrepancy: https://cwe.mitre.org/data/definitions/203.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (CVE not yet scored): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified for this CVE. No threat actor campaigns are associated with CVE-2026-110926 in the available intelligence.