SSH_DISCONNECT_COMPRESSION_ERROR
SSH_DISCONNECT_COMPRESSION_ERROR (6) is sent when decompression of an SSH packet payload fails. SSH supports optional zlib compression (none, zlib, [email protected]). If the decompressed data is invalid according to the compression algorithm, the receiver terminates the connection with this code.
Code
6
Category
Disconnect
Standard
RFC 4253 §11.1
Description
When SSH compression is negotiated, each packet payload is compressed before encryption. The receiver decrypts the packet and then decompresses the payload. If decompression fails (invalid zlib stream, incorrect checksum, or output exceeds the allowed buffer size), the receiver sends SSH_DISCONNECT_COMPRESSION_ERROR.
This disconnect is rare in practice because SSH compression is disabled by default in most modern configurations (OpenSSH has Compression no by default since it provides minimal benefit for already-encrypted data and can enable CRIME-style attacks on the compressed plaintext).
If this disconnect is received, it typically indicates a bug in the SSH implementation's compression layer rather than a network issue, since the packet would have failed the MAC check first if corrupted in transit.
Common Causes
- –Invalid zlib compressed payload in SSH packet
- –Compression context state desync between client and server
- –SSH implementation bug in compression layer
- –zlib decompression output exceeding allowed size limit