OpenSSH 10.6: the October 2026 security release

OpenSSH 10.6 fixes a compression side-channel, tightens command-line username handling, and enables a hybrid post-quantum signature by default.

By the Maborak engineering team · 2026-10-29 · 3 min read

OpenSSH 10.6 was released on 6 October 2026. It is a security release with several behaviour changes that affect clients and servers, not just servers on a hostile network. The project also states that, for now, it will release more frequently to get fixes out sooner rather than batching them.

Checked 29 October 2026. The changes below are summarised from the OpenSSH 10.6 release notes. We have not independently reproduced the compression attack.

Security changes

• Compression side-channel. The LZ77 dictionary coder is disabled, mitigating “Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels” by Fabian Bäumer and Marcus Brinkmann (preprint, 2026). The attack uses the compression dictionary shared across channels of one SSH session: attacker-controlled input reflects into ciphertext lengths through back-references, which can leak secrets from another channel. Expect compression to be less effective; the release recommends application-level compression over SSH where possible.
• Command-line usernames. ssh now refuses destination usernames that contain $ or \, to prevent shell injection through ProxyCommand, Match exec and similar expansion. Usernames set by the User directive in configuration files are not subject to this check.
• sftp path handling. sftp validates paths returned by the server more strictly, so a malicious server cannot steer a recursive copy outside the target directory.
• GSSAPI state. sshd stores GSSAPI credentials only after authentication succeeds and resets GSSAPI state before each attempt, so a failed attempt cannot be confused with a later success.
• Certificate expiry. ssh-keygen handles daylight-saving transitions when converting dates, which previous versions could get wrong by up to an hour and which could produce certificates with incorrect expiry times.
• Packet bounds. Compressed payloads are checked so they cannot inflate past the maximum supported packet length.
• restrict for tunnels. sshd now applies the authorized_keys restrict keyword to tunnel forwarding (disabled by default).
• none in Match. Options documented as accepting none, such as AuthorizedPrincipalsFile, no longer treat it as a literal filename when overridden inside a Match block.

Post-quantum signatures

The release enables a hybrid ssh-mldsa44-ed25519 signature algorithm. It deliberately drops the @openssh.com vendor suffix used by the earlier experimental implementation, so keys generated against that experiment must be regenerated or removed. Separately, sshd gains a WarnWeakCrypto option, enabled by default, that logs when a client uses a key-agreement scheme that is not post-quantum safe.

This is a compatibility item, not only a feature: an older client or a key generated during the experiment can fail or be refused. Check the negotiated algorithms with verbose client output before rolling the server change across a fleet.

Potentially incompatible changes

• Compression is less effective because the dictionary coder is gone.
• Command-line usernames containing $ or \ are now rejected.
• On platforms that do not support file-descriptor passing and that require root for PTY allocation, GatewayPorts and StreamLocalForwarding are forcibly disabled, because the post-authentication process could retain root and act outside the user’s controls.

Upgrading

Upgrade the client and the server together where possible. On each server:

sshd -t
systemctl reload sshd
ssh -V

sshd -t validates the configuration before reload. ssh -V confirms the binary you expect is the one on the path; a reload does not change which package the service manager starts if the package upgrade did not replace it.

Then verify a normal login, a key-based login, an SFTP transfer and, if you use it, agent forwarding. If you generate certificates, confirm the expiry timestamps after the upgrade; the daylight-saving fix changes values that were previously computed incorrectly.

Two small operational notes: the release begins deprecating scp -R, which emits a warning now and will later fall back to copying via the local host; and ssh-keygen now defaults to 32 KDF rounds instead of 24.

The primary reference is the OpenSSH 10.6 release notes, with the compression preprint at arXiv:2609.07709.

Topics: security