Read the docs
TI-2026-19286 Aliases CVE-2026-23943

Pre-auth SSH DoS via unbounded zlib inflate

Priority LOW 38CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * [email protected]: Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments. This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00684 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP3.0.1 and later—No fix listedCNA
ErlangOTP17.0 and later—No fix listedCNA
  • OTP VendorErlang Affected 3.0.1 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 26.2.5.18; 27.0 to before 27.3.4.9; 28.0 to before 28.4.1VulnerableErlang
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*3.0.1 to before 5.1.4.14; 5.2 to before 5.2.11.6; 5.5 – 5.5.1VulnerableErlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 26.2.5.18; 27.0 to before 27.3.4.9; 28.0 to before 28.4.1 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:* Versions 3.0.1 to before 5.1.4.14; 5.2 to before 5.2.11.6; 5.5 – 5.5.1 Vulnerable ·Erlang

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23943
  2. 2026-10-11 EPSS moved to the 50th–90th percentile

References

Patch 3

Advisory 3

Other 1

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
  • TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
  • TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
  • TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences