What is CVE-2026-106585?

CVE-2026-106585 is a security advisory published by Microsoft Security Response Center (MSRC) with Medium severity. In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

Which CVE IDs does CVE-2026-106585 cover?

CVE-2026-106585 covers the following CVE IDs: CVE-2026-106585. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-106585?

CVE-2026-106585 has a CVSS v3 base score of 6.5, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-106585?

CVE-2026-106585 affects 1 product, including: azl3 openssh 9.8p1-10 on Azure Linux 3.0.

CVE-2026-106585MediumCVSS 6.5

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

Vendor

Microsoft Security Response Center (MSRC)

Published

October 8, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-106585 →

🎯 Affected products1

azl3 openssh 9.8p1-10 on Azure Linux 3.0

✅ Remediation

KBRelease Notes (Security Update)

🔗 References (2)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106585
referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade