OpenSSH 10.6 changes compression and tightens file-transfer checks

OpenSSH 10.6 disables dictionary-based compression to reduce information leaks between channels sharing an SSH connection. It also tightens checks on paths returned by SFTP servers and rejects additional characters in command-line usernames. These changes address specific ways untrusted data can cross boundaries, while potentially changing compression efficiency and the behavior of existing automation.

OpenSSH · Oct 6, 2026

Why it matters

Infrastructure teams should review both the fixes and compatibility changes before upgrading their SSH tooling.

More context

Check your operating system’s packaging and test representative transfers and connection scripts. The release also enables a hybrid post-quantum signature algorithm; keys from its earlier experimental form need replacement. The remote-copy scp -R option now warns about future deprecation.

Keep in mind

Upstream release availability does not mean every distribution has shipped it. These fixes have different preconditions and do not imply all SSH sessions were vulnerable. No servers were upgraded for this article.

Original read