CVE-2026-23943

Erlang OTP ssh (ssh_transport modullari) da yuqori darajada siqilgan ma'lumotlar (Compression Bomb) zaifligini noto'g'ri qayta ishlash resurslarni kamaytirish orqali xizmatdan voz kechishga imkon beradi.

 SSH transport qatlami sukut bo'yicha eski zlib siqishni reklama qiladi va hech qanday o'lcham cheklovisiz hujumchi tomonidan boshqariladigan yuklarni oldindan autentifikatsiya qilishni oshiradi, bu esa xotirani ishonchli ravishda yo'qotish DoS ni ta'minlaydi.

 Ikkita siqish algoritmi ta'sir qiladi:

 * zlib: Kalit almashinuvidan so'ng darhol faollashadi va tasdiqlanmagan hujumlarni yoqadi
 * zlib@op

Manbalar

• https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4
• https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1
• https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3
• https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r
• https://www.erlang.org/doc/system/versions.html#order-of-versions