CVE-2026-23943: Pre-auth SSH DoS via unbounded zlib inflate
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.7%
EPSS score, percentile 51.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 6.9 Medium
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- 3.0.1
- 17.0
Unaffected from 5.5.1; from 5.2.11.6; from 5.1.4.14; from 28.4.1; from 27.3.4.9; from 26.2.5.18
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Workaround (from the CVE record)
Best workaround - Disable all compression: {preferred_algorithms, [{compression, ['none']}]} Alternative mitigations (less secure): * Disable only pre-auth zlib compression (authenticated users can still exploit via [email protected]): {modify_algorithms, [{rm, [{compression, ['zlib']}]}]} * Limit concurrent sessions (reduces attack surface but does not prevent exploitation): {max_sessions, N} % Cap total concurrent sessions (default is infinity)
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 3.0.1 |
| Unaffected | from 5.5.1 |
| Unaffected | from 5.2.11.6 |
| Unaffected | from 5.1.4.14 |
Versions not listed are: unknown.
| Status | Versions |
|---|---|
| Affected | 17.0 |
| Unaffected | from 28.4.1 |
| Unaffected | from 27.3.4.9 |
| Unaffected | from 26.2.5.18 |
| Affected | 07b8f441ca71 |
| Unaffected | from 43a87b949bdf |
| Unaffected | from 93073c3bd338 |
| Unaffected | from 0c1c04b191f6 |
Versions not listed are: unknown.
Versions the record lists as unaffected: 5.5.1, 5.2.11.6, 5.1.4.14, 28.4.1, 27.3.4.9, 26.2.5.18, 43a87b949bdff12d629a8c34146711d9da93b1b1, 93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3.
Source: CVE List, as of . About the data.
About this vulnerability
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are af…
Summary: CVE record, as of .
- CISA has not added CVE-2026-23943 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 13 Mar 2026.
- The CVE record carries a CVSS v4.0 base score of 6.9 (Medium), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.7% (percentile 51.9), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact partial.
- The credits in the CVE record name AISLE as finder.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
Pre-auth SSH DoS via unbounded zlib inflate
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * [email protected]: Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments. This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.
Source: CVE List, as of . About the data.
Weakness
CWE-409, 2 CAPEC
- CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Attack patterns (CAPEC)
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
3
Known exploited Erlang vulnerabilities
- CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability