# CVE-2026-23943: Pre-auth SSH DoS via unbounded zlib inflate

Status: published. Published: 2026-03-13. Updated: 2026-11-11.

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.

The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.

Two compression algorithms are affected:

* zlib: Activates immediately after key exchange, enabling unauthenticated attacks
* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks

Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.

This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1.

## Remediation

- workaround: Best workaround - Disable all compression:

{preferred_algorithms, [{compression, ['none']}]}

Alternative mitigations (less secure):

* Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):
{modify_algorithms, [{rm, [{compression, ['zlib']}]}]}
* Limit concurrent sessions (reduces attack surface but does not prevent exploitation):
{max_sessions, N}  % Cap total concurrent sessions (default is infinity) (source: CNA: EEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1

## Affected products and versions

- Erlang / OTP (otp): ≥ 17.0; < * (affected, otp); unaffected at 26.2.5.18; unaffected at 27.3.4.9; unaffected at 28.4.1. Source: CNA: EEF
- Erlang / OTP (ssh): ≥ 3.0.1; < * (affected, otp); unaffected at 5.1.4.14; unaffected at 5.2.11.6; unaffected at 5.5.1. Source: CNA: EEF
- Erlang / OTP (erlang/otp): ≥ 07b8f441ca711f9812fad9e9115bab3c3aa92f79; < * (affected, git); unaffected at 0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4; unaffected at 93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3; unaffected at 43a87b949bdff12d629a8c34146711d9da93b1b1. Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.73% as of 2026-11-10; percentile 54.43%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-409

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-23943.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-23943 (CNA: EEF; related)

- https://www.erlang.org/doc/system/versions.html#order-of-versions (CNA: EEF; x_version-scheme)

- https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79 (CNA: EEF; related)

- https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1 (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-23943; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-23943; retrieved 2026-11-11; source updated Not reported

Revision: aafe007ea08bebad996c001f2083f3dc69df61e1a084bf6ca2a1449cd334288e

Canonical: https://y2.dev/cve/CVE-2026-23943

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.