CVE-2026-23943

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23943
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@openssh.com: Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments. This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and 26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-23943.html Vendor Advisory
https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4 Patch
https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1 Patch
https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 Patch
https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-23943 Third Party Advisory
https://www.erlang.org/doc/system/versions.html#order-of-versions Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
History

21 May 2026, 15:22

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
First Time Erlang
Erlang erlang\/otp
Erlang erlang\/ssh
CPE cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
References () https://cna.erlef.org/cves/CVE-2026-23943.html - () https://cna.erlef.org/cves/CVE-2026-23943.html - Vendor Advisory
References () https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4 - () https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4 - Patch
References () https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1 - () https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1 - Patch
References () https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 - () https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 - Patch
References () https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r - () https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r - Vendor Advisory
References () https://osv.dev/vulnerability/EEF-CVE-2026-23943 - () https://osv.dev/vulnerability/EEF-CVE-2026-23943 - Third Party Advisory
References () https://www.erlang.org/doc/system/versions.html#order-of-versions - () https://www.erlang.org/doc/system/versions.html#order-of-versions - Product

06 Apr 2026, 17:17

Type Values Removed Values Added
References
  • () https://cna.erlef.org/cves/CVE-2026-23943.html -
  • () https://osv.dev/vulnerability/EEF-CVE-2026-23943 -
Summary
  • (es) La vulnerabilidad de Manejo Inadecuado de Datos Altamente Comprimidos (Bomba de Compresión) en Erlang OTP ssh (módulos ssh_transport) permite la denegación de servicio mediante el agotamiento de recursos. La capa de transporte SSH anuncia la compresión zlib heredada por defecto e infla cargas útiles controladas por el atacante pre-autenticación sin ningún límite de tamaño, lo que permite una DoS fiable por agotamiento de memoria. Dos algoritmos de compresión se ven afectados: * zlib: Se activa inmediatamente después del intercambio de claves, lo que permite ataques no autenticados * zlib@openssh.com: Se activa post-autenticación, lo que permite ataques autenticados Cada paquete SSH puede descomprimir ~255 MB de 256 KB de datos en la red (relación de amplificación de 1029:1). Múltiples paquetes pueden agotar rápidamente la memoria disponible, causando eliminaciones por OOM en entornos con memoria limitada. Esta vulnerabilidad está asociada con los archivos de programa lib/ssh/src/ssh_transport.erl y las rutinas de programa ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. Este problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.1, 27.3.4.9 y 26.2.5.18, lo que corresponde a ssh desde 3.0.1 hasta 5.5.1, 5.2.11.6 y 5.1.4.14.

13 Mar 2026, 19:54

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-13 19:54

Updated : 2026-05-21 15:22

NVD link : CVE-2026-23943

Mitre link : CVE-2026-23943

CVE.ORG link : CVE-2026-23943

JSON object : View

Products Affected

erlang

  • erlang\/ssh
  • erlang\/otp
CWE
CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)