In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1a3ae49d07 advisory.

    Fix CVE-2026-106585: Denial of service via oversized decompressed packets

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792933338 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792933979 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792935277 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792935277 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792932827 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a2ed02274a advisory.

    Fix CVE-2026-106585: Denial of service via oversized decompressed packets

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792158099 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792078892 advisory.

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is     exceeded during decompression of highly compressed data. (CVE-2026-106585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8937-1 advisory.

    It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a     recursive copy operation. A remote attacker controlling the server could possibly use this issue to write     files to unintended locations. (CVE-2026-106552)

    It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across     authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous     failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)

    It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker     could possibly use this issue to obtain sensitive information. (CVE-2026-106582)

    It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line     usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted     usernames. (CVE-2026-106583)

    It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting     dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times.
    (CVE-2026-106584)

    It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during     decompression. A remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-106585)

    It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys     to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to     bypass intended tunnel forwarding restrictions. (CVE-2026-106586)

    It was discovered that OpenSSH's sshd server incorrectly handled certain configuration options that accept     a none value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly.
    (CVE-2026-106587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8928-1 advisory.

    It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a     recursive copy operation. A remote attacker controlling the server could possibly use this issue to write     files to unintended locations. (CVE-2026-106552)

    It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across     authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous     failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)

    It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker     could possibly use this issue to obtain sensitive information. (CVE-2026-106582)

    It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line     usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted     usernames. (CVE-2026-106583)

    It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting     dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times.
    (CVE-2026-106584)

    It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during     decompression. A remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-106585)

    It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys     to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to     bypass intended tunnel forwarding restrictions. (CVE-2026-106586)

    It was discovered that OpenSSH's sshd server incorrectly handled certain configuration options that accept     a none value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly.
    (CVE-2026-106587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792197391 advisory.

  - In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to     unintended locations) during a recursive copy operation. (CVE-2026-106552)

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is     contraindicated by the arXiv 2609.07709 Crossing the Streams findings. (CVE-2026-106582)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is
    exceeded during decompression of highly compressed data. (CVE-2026-106585)

ID	Name	Product	Family	Type	Severity
372884	Fedora 43 : openssh (2026-1a3ae49d07)	Nessus	Fedora Local Security Checks	Local	medium
371943	CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792933338)	Nessus	CentOS Local Security Checks	Local	high
371942	CentOS Linux 8.5 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792933979)	Nessus	CentOS Local Security Checks	Local	high
371941	Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792935277)	Nessus	Rocky Linux Local Security Checks	Local	high
371940	AlmaLinux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792935277)	Nessus	Alma Linux Local Security Checks	Local	high
371939	CentOS Linux 8 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792932827)	Nessus	CentOS Local Security Checks	Local	high
371738	Fedora 44 : openssh (2026-a2ed02274a)	Nessus	Fedora Local Security Checks	Local	medium
371374	Linux Distros Unpatched Vulnerability : CVE-2026-106585	Nessus	Misc.	Local	medium
369488	CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792158099)	Nessus	CentOS Local Security Checks	Local	high
367914	CentOS Linux 6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-ldap / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792078892)	Nessus	CentOS Local Security Checks	Local	high
367750	Ubuntu 26.10 : OpenSSH vulnerabilities (USN-8937-1)	Nessus	Ubuntu Local Security Checks	Local	high
367205	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenSSH vulnerabilities (USN-8928-1)	Nessus	Ubuntu Local Security Checks	Local	high
366706	AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792197391)	Nessus	Alma Linux Local Security Checks	Local	high
473742	Echo: openssh: security update to 1:10.6p1-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473742	Echo: openssh: security update to 1:10.6p1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-106585

medium

Tenable Plugins

medium

high

high

high

high

high

medium

medium

high

high

high

high

high

medium

medium