{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2026-015",
  "link": "https://tailscale.com/security-bulletins/#ts-2026-015",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2026-015",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Mon, 26 Oct 2026 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Memory exhaustion in Tailscale SSH session handling could lead to denial of service.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003e\u003ca href=\"https://tailscale.com/docs/features/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e provides a secure shell server integrated into \u003ccode\u003etailscaled\u003c/code\u003e. An issue in the embedded SSH server\u0027s session handling allowed authenticated peers to cause unbounded memory growth in the \u003ccode\u003etailscaled\u003c/code\u003e process. This occurred through continuous window-change messages and environment variable appends within a session. These allocations persisted even after the peer disconnected.\u003c/p\u003e\n\u003cp\u003eTailscale now bounds the memory used for session handling and releases it when the peer disconnects.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is fixed in Tailscale version 1.104.4 or newer.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker could exhaust available memory on the host, leading to an out-of-memory (OOM) kill of the \u003ccode\u003etailscaled\u003c/code\u003e process. Because \u003ccode\u003etailscaled\u003c/code\u003e is central to all node networking state, such a crash disrupts every Tailscale connection on the node.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eThis issue affects nodes running the Tailscale SSH server. An authenticated SSH session permitted by policy is required to trigger the condition.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you use Tailscale SSH, upgrade to Tailscale version 1.104.4 or newer.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Memory exhaustion in Tailscale SSH session handling could lead to denial of service.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003e\u003ca href=\"https://tailscale.com/docs/features/tailscale-ssh\"\u003eTailscale SSH\u003c/a\u003e provides a secure shell server integrated into \u003ccode\u003etailscaled\u003c/code\u003e. An issue in the embedded SSH server\u0027s session handling allowed authenticated peers to cause unbounded memory growth in the \u003ccode\u003etailscaled\u003c/code\u003e process. This occurred through continuous window-change messages and environment variable appends within a session. These allocations persisted even after the peer disconnected.\u003c/p\u003e\n\u003cp\u003eTailscale now bounds the memory used for session handling and releases it when the peer disconnects.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is fixed in Tailscale version 1.104.4 or newer.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker could exhaust available memory on the host, leading to an out-of-memory (OOM) kill of the \u003ccode\u003etailscaled\u003c/code\u003e process. Because \u003ccode\u003etailscaled\u003c/code\u003e is central to all node networking state, such a crash disrupts every Tailscale connection on the node.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003eThis issue affects nodes running the Tailscale SSH server. An authenticated SSH session permitted by policy is required to trigger the condition.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eIf you use Tailscale SSH, upgrade to Tailscale version 1.104.4 or newer.\u003c/p\u003e"
  },
  "title": "TS-2026-015",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2026-015"
  }
}