CVE-2026-110927
MEDIUMCVSS 4.3/10
Last modified
CVE-2026-110927 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit.
Description
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Hardened Images | All versions |
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 6 | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
| Red Hat | Red Hat OpenShift Container Platform 4 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110927?
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
How severe is CVE-2026-110927?
CVE-2026-110927 has a CVSS score of 4.3/10 (MEDIUM severity).
How do I fix CVE-2026-110927?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110912In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input…7.1
- CVE-2026-11092Insufficient policy enforcement in DevTools in Google Chrome…8.8
- CVE-2026-110923A flaw was found in OpenSSH. During an sftp copy, a maliciou…6.5
- CVE-2026-110924A flaw was found in OpenSSH. With GSSAPI authentication enab…4.8
- CVE-2026-110925A flaw was found in OpenSSH. A username entered on the ssh c…5.4
- CVE-2026-110926A flaw was found in OpenSSH. When compression is negotiated,…5.3
- CVE-2026-11093Inappropriate implementation in Printing in Google Chrome pr…6.5
- CVE-2026-110933Uncaught exception vulnerability in Samsung Open Source Vyon…4.4
- CVE-2026-110934Improper validation of array index vulnerability in Samsung …4.4
- CVE-2026-110936A vulnerability has been identified in Siemens Software Cent…6.7
- CVE-2026-11094Use after free in Codecs in Google Chrome on Windows prior t…9.6
- CVE-2026-11095Insufficient validation of untrusted input in Codecs in Goog…9.6
Are you affected by CVE-2026-110927?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST