CVE-2026-110926 in Red Hat
Summary
by MITRE • 10/15/2026
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as CVE-2019-6111 represents a critical security flaw within OpenSSH, specifically affecting the implementation of data compression over secure shell connections. This issue arises when both the client and server negotiate the use of compression for their communication channel. In this configuration, multiple channels established on the same TCP connection share a single LZ77 dictionary to facilitate efficient data transmission by replacing repeated sequences with shorter references. The fundamental technical flaw lies in the fact that this shared state is not properly isolated between different logical channels operating over the same encrypted tunnel. Consequently, an attacker who can write data into one channel can influence the compression dictionary used by another channel on the same connection. This cross-channel interference allows for a sophisticated side-channel attack where the attacker can exploit the variable length of compressed output to infer information about plaintext being transmitted in other channels.
The operational impact of this vulnerability is severe, as it potentially compromises the confidentiality of sensitive data exchanged over SSH sessions that utilize compression. By carefully crafting chosen-plaintext inputs and observing the resulting ciphertext lengths on a targeted channel, an adversary can perform statistical analysis to recover parts or all of the plaintext from another active session. This type of attack leverages the correlation between input size and compressed output size, which is inherent in LZ77-based algorithms when state is shared across contexts. The risk is particularly acute for users who rely on SSH compression for performance optimization while simultaneously managing multiple concurrent sessions or channels within a single connection. If an attacker has access to one of these channels, either through privilege escalation, session hijacking, or by being part of the same network segment with sufficient visibility and interaction capabilities, they can systematically deduce sensitive information such as passwords, private keys, or proprietary data transmitted over other channels in the same SSH session.
From a classification perspective, this vulnerability aligns closely with CWE-200: Information Exposure, specifically through side-channel observations of compressed data sizes. It also relates to CWE-367: Time-of-check Time-of-use (TOCTOU) race conditions in terms of state management across shared resources, although the primary mechanism is more accurately described as a cross-context information leak due to improper isolation of compression dictionaries. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection and Exfiltration over C2 channels, particularly those involving data staging or exfiltration via SSH tunnels where attackers might abuse legitimate administrative tools for malicious purposes. The ability to recover plaintext from compressed streams undermines the core security guarantees provided by encryption when combined with compression features that leak length-based metadata.
Mitigation strategies primarily involve disabling SSH compression on both client and server sides, as this eliminates the shared dictionary mechanism entirely. Administrators should review their sshd_config files to ensure that Compression is set to no or disabled for all relevant services. For environments where performance optimization via compression is critical, organizations must assess whether they can tolerate the risk of cross-channel information leakage. If compression cannot be disabled, it is imperative to enforce strict isolation between sessions by ensuring that each SSH connection operates independently without multiplexing multiple channels over a single TCP stream unless absolutely necessary and fully understood in terms of security implications. Additionally, keeping OpenSSH updated to versions where this flaw has been patched is essential for systems running older releases. Security teams should also monitor for anomalous patterns in network traffic that might indicate active exploitation attempts, although such detection remains challenging due to the subtle nature of length-based side-channel attacks. Regular audits of SSH configurations and adherence to hardening guidelines provided by industry standards like CIS Benchmarks can further reduce the attack surface associated with this vulnerability.