This vulnerability (CVE-2026-23943) in Erlang OTP's ssh_transport modules arises from improper handling of highly compressed data, specifically legacy zlib compression used by the SSH transport layer. The SSH implementation advertises zlib compression by default and decompresses attacker-controlled payloads without size limits, enabling denial of service via memory exhaustion. Two compression algorithms are affected: 'zlib', which activates immediately after key exchange allowing unauthenticated attacks, and 'zlib@openssh.com', which activates post-authentication allowing authenticated attacks. Each SSH packet can decompress approximately 255 MB from 256 KB of wire data, resulting in a 1029:1 amplification ratio. Multiple packets can rapidly consume available memory, causing out-of-memory kills in memory-constrained systems. The affected OTP versions range from 17.0 through 28.4.1, 27.3.4.9, and 26.2.5.18, with corresponding ssh versions from 3.0.1 through 5.5.1, 5.2.11.6, and 5.1.4.14.

An attacker can cause a denial of service by sending specially crafted compressed SSH packets that decompress to a much larger size, exhausting system memory. This can lead to out-of-memory kills and service disruption. The unauthenticated attack vector via the 'zlib' compression algorithm after key exchange increases the risk as no authentication is required to trigger the vulnerability. The authenticated attack vector via 'zlib@openssh.com' allows an attacker with valid credentials to also exploit this issue. The vulnerability affects systems running vulnerable versions of Erlang OTP SSH transport, potentially impacting availability in memory-constrained environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling legacy zlib compression in the SSH transport layer if possible to prevent exploitation. Monitor for updates from the Erlang project regarding patches or configuration changes that mitigate this vulnerability. Avoid enabling or using the affected compression algorithms in environments where memory exhaustion could cause critical impact.