Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advert…
Summary
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@o…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.erlang.org/doc/system/versions.html#order-of-versions
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-23943.html Vendor Advisory
- https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4 Patch
- https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1 Patch
- https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 Patch
- https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-23943 Third Party Advisory
- https://www.erlang.org/doc/system/versions.html#order-of-versions Product
Timeline
- nvd_ingest NVD