CVE-2026-106585
Publication date 7 October 2026
Last updated 19 October 2026
Ubuntu priority
Description
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| openssh | 26.10 stonking |
Fixed in 1:10.5p1-1ubuntu3.1
|
| 26.04 LTS resolute |
Fixed in 1:10.2p1-2ubuntu3.8
|
|
| 24.04 LTS noble |
Fixed in 1:9.6p1-3ubuntu13.20
|
|
| 22.04 LTS jammy |
Fixed in 1:8.9p1-3ubuntu0.18
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
|
| openssh-ssh1 | 26.10 stonking | Ignored |
| 26.04 LTS resolute | Ignored | |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic | Ignored | |
| openssh-gssapi | 26.10 stonking |
Fixed in 1:10.5p1-1ubuntu3.1
|
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Notes
mdeslaur
openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.5 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
Related Ubuntu Security Notices (USN)
- USN-8928-1
- OpenSSH vulnerabilities
- 14 October 2026
- USN-8937-1
- OpenSSH vulnerabilities
- 19 October 2026