{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23943", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-01-19T14:23:14.343Z", "datePublished": "2026-03-13T09:11:57.794Z", "dateUpdated": "2026-07-24T14:15:38.635Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_transport"], "packageName": "ssh", "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssh_transport.erl"], "programRoutines": [{"name": "ssh_transport:decompress/2"}, {"name": "ssh_transport:handle_packet_part/4"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.5.1", "status": "unaffected"}, {"at": "5.2.11.6", "status": "unaffected"}, {"at": "5.1.4.14", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.0.1", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_transport"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_transport.erl"], "programRoutines": [{"name": "ssh_transport:decompress/2"}, {"name": "ssh_transport:handle_packet_part/4"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "28.4.1", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "26.2.5.18", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}, {"changes": [{"at": "43a87b949bdff12d629a8c34146711d9da93b1b1", "status": "unaffected"}, {"at": "93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3", "status": "unaffected"}, {"at": "0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The SSH server or client must advertise <tt>zlib</tt> or <tt>zlib@openssh.com</tt> compression. Both are enabled by default. With <tt>zlib</tt>, the attack is pre-authentication; with <tt>zlib@openssh.com</tt>, authentication is required first."}], "value": "The SSH server or client must advertise zlib or zlib@openssh.com compression. Both are enabled by default. With zlib, the attack is pre-authentication; with zlib@openssh.com, authentication is required first."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2.5.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Micha\u0142 W\u0105sowski"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Witczak"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.<p>The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.</p><p>Two compression algorithms are affected:</p><ul><li><b>zlib:</b> Activates immediately after key exchange, enabling unauthenticated attacks</li><li><b>zlib@openssh.com:</b> Activates post-authentication, enabling authenticated attacks</li></ul><p>Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.</p><p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_transport.erl</tt> and program routines <tt>ssh_transport:decompress/2</tt>, <tt>ssh_transport:handle_packet_part/4</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.1, OTP&nbsp;27.3.4.9 and OTP&nbsp;26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.</p>"}], "value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks\n\nEach SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.\n\nThis issue affects OTP from OTP 17.0 before OTP\u00a028.4.1, OTP\u00a027.3.4.9 and OTP\u00a026.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}, {"capecId": "CAPEC-490", "descriptions": [{"lang": "en", "value": "CAPEC-490 Amplification"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-07-24T14:15:38.635Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-23943.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23943"}, {"tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4"}], "source": {"discovery": "EXTERNAL"}, "title": "Pre-auth SSH DoS via unbounded zlib inflate", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><b>Best workaround - Disable all compression:</b></p><pre>{preferred_algorithms, [{compression, ['none']}]}</pre><p><b>Alternative mitigations (less secure):</b></p><ul><li>Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):<pre>{modify_algorithms, [{rm, [{compression, ['zlib']}]}]}</pre></li><li>Limit concurrent sessions (reduces attack surface but does not prevent exploitation):<pre>{max_sessions, N} % Cap total concurrent sessions (default is infinity)</pre></li></ul>"}], "value": "Best workaround - Disable all compression:\n\n{preferred_algorithms, [{compression, ['none']}]}\n\nAlternative mitigations (less secure):\n\n* Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):\n {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}\n* Limit concurrent sessions (reduces attack surface but does not prevent exploitation):\n {max_sessions, N} % Cap total concurrent sessions (default is infinity)"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:01:40.898658Z", "id": "CVE-2026-23943", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:01:48.609Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:01:40.898658Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:01:44.722Z"}}], "cna": {"title": "Pre-auth SSH DoS via unbounded zlib inflate", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Micha\u0142 W\u0105sowski"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Witczak"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}, {"capecId": "CAPEC-490", "descriptions": [{"lang": "en", "value": "CAPEC-490 Amplification"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssh_transport"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "5.5.1", "status": "unaffected"}, {"at": "5.2.11.6", "status": "unaffected"}, {"at": "5.1.4.14", "status": "unaffected"}], "version": "3.0.1", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssh", "programFiles": ["src/ssh_transport.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_transport:decompress/2"}, {"name": "ssh_transport:handle_packet_part/4"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssh_transport"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "28.4.1", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "26.2.5.18", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}, {"status": "affected", "changes": [{"at": "43a87b949bdff12d629a8c34146711d9da93b1b1", "status": "unaffected"}, {"at": "93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3", "status": "unaffected"}, {"at": "0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4", "status": "unaffected"}], "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/ssh/src/ssh_transport.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_transport:decompress/2"}, {"name": "ssh_transport:handle_packet_part/4"}]}], "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-23943.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23943", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Best workaround - Disable all compression:\n\n{preferred_algorithms, [{compression, ['none']}]}\n\nAlternative mitigations (less secure):\n\n* Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):\n {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}\n* Limit concurrent sessions (reduces attack surface but does not prevent exploitation):\n {max_sessions, N} % Cap total concurrent sessions (default is infinity)", "supportingMedia": [{"type": "text/html", "value": "<p><b>Best workaround - Disable all compression:</b></p><pre>{preferred_algorithms, [{compression, ['none']}]}</pre><p><b>Alternative mitigations (less secure):</b></p><ul><li>Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):<pre>{modify_algorithms, [{rm, [{compression, ['zlib']}]}]}</pre></li><li>Limit concurrent sessions (reduces attack surface but does not prevent exploitation):<pre>{max_sessions, N} % Cap total concurrent sessions (default is infinity)</pre></li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks\n\nEach SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.\n\nThis issue affects OTP from OTP 17.0 before OTP\u00a028.4.1, OTP\u00a027.3.4.9 and OTP\u00a026.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.", "supportingMedia": [{"type": "text/html", "value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.<p>The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.</p><p>Two compression algorithms are affected:</p><ul><li><b>zlib:</b> Activates immediately after key exchange, enabling unauthenticated attacks</li><li><b>zlib@openssh.com:</b> Activates post-authentication, enabling authenticated attacks</li></ul><p>Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.</p><p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_transport.erl</tt> and program routines <tt>ssh_transport:decompress/2</tt>, <tt>ssh_transport:handle_packet_part/4</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.1, OTP&nbsp;27.3.4.9 and OTP&nbsp;26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "configurations": [{"lang": "en", "value": "The SSH server or client must advertise zlib or zlib@openssh.com compression. Both are enabled by default. With zlib, the attack is pre-authentication; with zlib@openssh.com, authentication is required first.", "supportingMedia": [{"type": "text/html", "value": "The SSH server or client must advertise <tt>zlib</tt> or <tt>zlib@openssh.com</tt> compression. Both are enabled by default. With <tt>zlib</tt>, the attack is pre-authentication; with <tt>zlib@openssh.com</tt>, authentication is required first.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.2.5.18"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-07-24T14:15:38.635Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23943", "state": "PUBLISHED", "dateUpdated": "2026-07-24T14:15:38.635Z", "dateReserved": "2026-01-19T14:23:14.343Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-03-13T09:11:57.794Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_transport"], "packageName": "ssh", "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssh_transport.erl"], "programRoutines": [{"name": "ssh_transport:decompress/2"}, {"name": "ssh_transport:handle_packet_part/4"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.5.1", "status": "unaffected"}, {"at": "5.2.11.6", "status": "unaffected"}, {"at": "5.1.4.14", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.0.1", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_transport"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_transport.erl"], "programRoutines": [{"name": "ssh_transport:decompress/2"}, {"name": "ssh_transport:handle_packet_part/4"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "28.4.1", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "26.2.5.18", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}, {"changes": [{"at": "43a87b949bdff12d629a8c34146711d9da93b1b1", "status": "unaffected"}, {"at": "93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3", "status": "unaffected"}, {"at": "0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "6241E245-67D2-4FA6-83FE-4E9A4A07B3D1", "versionEndExcluding": "26.2.5.18", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE60BA92-431E-4DE3-A1C1-E8976E3A6BA7", "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8D9E80B-CA20-423A-A1A8-DEBB99D82BDB", "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "24FD89BF-28BB-4432-9FDA-F0D84B5F716C", "versionEndExcluding": "5.1.4.14", "versionStartIncluding": "3.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0BFA1FA-14CC-4A47-A6A3-2572BA686367", "versionEndExcluding": "5.2.11.6", "versionStartIncluding": "5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ABFC1FB-435C-414A-BF43-B119730E3DCE", "versionEndIncluding": "5.5.1", "versionStartIncluding": "5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks\n\nEach SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and 26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14."}, {"lang": "es", "value": "La vulnerabilidad de Manejo Inadecuado de Datos Altamente Comprimidos (Bomba de Compresi\u00f3n) en Erlang OTP ssh (m\u00f3dulos ssh_transport) permite la denegaci\u00f3n de servicio mediante el agotamiento de recursos.\n\nLa capa de transporte SSH anuncia la compresi\u00f3n zlib heredada por defecto e infla cargas \u00fatiles controladas por el atacante pre-autenticaci\u00f3n sin ning\u00fan l\u00edmite de tama\u00f1o, lo que permite una DoS fiable por agotamiento de memoria.\n\nDos algoritmos de compresi\u00f3n se ven afectados:\n\n* zlib: Se activa inmediatamente despu\u00e9s del intercambio de claves, lo que permite ataques no autenticados\n* zlib@openssh.com: Se activa post-autenticaci\u00f3n, lo que permite ataques autenticados\n\nCada paquete SSH puede descomprimir ~255 MB de 256 KB de datos en la red (relaci\u00f3n de amplificaci\u00f3n de 1029:1). M\u00faltiples paquetes pueden agotar r\u00e1pidamente la memoria disponible, causando eliminaciones por OOM en entornos con memoria limitada.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/ssh/src/ssh_transport.erl y las rutinas de programa ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.1, 27.3.4.9 y 26.2.5.18, lo que corresponde a ssh desde 3.0.1 hasta 5.5.1, 5.2.11.6 y 5.1.4.14."}], "id": "CVE-2026-23943", "lastModified": "2026-06-17T10:22:19.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23943", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:01:40.898658Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:15.783", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-23943.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23943"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.1,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:otp/ssh@3.0.1,pkg:otp/ssh@*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b8f441ca711f9812fad9e9115bab3c3aa92f79,*]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.1,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:otp/ssh@3.0.1,pkg:otp/ssh@*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b8f441ca711f9812fad9e9115bab3c3aa92f79,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "analysis": {"en": {"generated_at": "2026-03-19T15:25:45.871402+00:00", "value": {"mitigation_remediation": ["Disable all SSH compression by setting {preferred_algorithms, [{compression, ['none']}]}.", "If disabling all compression is not feasible, disable only the pre\u2011authentication zlib compression: {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}.", "Limit the total number of concurrent SSH sessions with {max_sessions, N} to reduce the attack surface."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "OTP releases from 17.0 through 28.4.1, 27.3.4.9, and 26.2.5.18 (corresponding to SSH libraries 3.0.1 to 5.5.1, 5.2.11.6, and 5.1.4.14) are affected when using the default SSH configuration. All deployments of these OTP releases are vulnerable.", "description_and_impact": "The vulnerability arises from improper handling of highly compressed data (compression bomb) in Erlang OTP SSH, where the SSH transport layer inflates zlib packets before authentication without any size limit. This unbounded decompression allows an attacker to send a small compressed payload that expands to hundreds of megabytes, consuming server memory and causing an out\u2011of\u2011memory termination or prolonged unavailability. The weakness is classified as CWE\u2011409: Excessive Resource Consumption, directly leading to a denial\u2011of\u2011service impact without granting code execution or data exfiltration capabilities.", "risk_and_exploitability": "The CVSS score is 6.9 indicating moderate severity. EPSS indicates exploitation probability below 1%, and the vulnerability is not listed in the CISA KEV catalog. Exfiltration of data or code execution is not possible; the attack is limited to memory exhaustion. The likely attack vector is remote, unauthenticated via the pre\u2011authentication zlib compression algorithm on the SSH port. An attacker with network connectivity can repeatedly send compressed packets to de memory and induce a denial\u2011of\u2011service. Authenticated exploitation is also possible via the zlib@openssh.com algorithm, but the impact remains a service outage."}}}}, "created": "2026-03-16T09:37:49.019975+00:00", "updated": "2026-03-23T09:59:34.896893+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}