SSH Compression After OpenSSH 10.6: What Changed (2026)

OpenSSH 10.6, released on October 6, 2026, made a change to SSH compression that purposefully reduces its effectiveness. The Compression option still exists and negotiates zlib@openssh.com, but it now disables the LZ77 dictionary coder. This change was made to mitigate side-channel leaks described in a 2026 paper titled "Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels."

The code change involves a single call in packet.c, switching from zlib's deflateInit(stream, 6) to deflateInit2(&ssh_state_compression_out_stream, Z_BEST_SPEED, Z_DEFLATED, 15, 8, Z_HUFFMAN_ONLY). Huffman-only compression skips string matching, resulting in less compression for data with long repeated strings, such as JSON logs. However, it still works for data with skewed character distributions and already-compressed or encrypted data.

In tests with OpenSSH 10.5p1 and 10.6p1 from source, the 10.6 version sent more bytes on the wire when compressing text, JSON logs, and random data compared to the 10.5 version. For example, with text data, 10.5 sent 4,338,600 bytes (compressed size 0.27 of the original), while 10.6 sent 10,191,048 bytes (compressed size 0.63 of the original), a 2.3 times increase in traffic. With JSON logs, the factor increased from 0.06 to 0.60, more than 9 times more traffic.

The change applies per direction, meaning a 10.6 client uploading to an older server is weaker on the upload and unchanged on the download until both sides are patched. On local loopback, where bandwidth is free, the 10.6 upload of a text file took less time than the 10.5 one due to Huffman-only being cheaper to compute.

The version number of OpenSSH does not reliably indicate which behavior a system has, as distributions may backport security fixes into older versions. Instead, measure the actual compression behavior by downloading a file with ssh -C and checking the negotiated compression method and achieved ratio during key exchange. The output of ssh -v will show this information.