A compression side channel is an information leak where an attacker learns about hidden data by watching how its compressed size changes. Compression algorithms shrink repeated patterns, so if secret text and attacker-controlled text are compressed together, matching guesses can make the output slightly smaller. That size difference can reveal whether a guess was close to the secret, even though the data remains encrypted.
This matters because it turns a performance feature into a confidentiality risk. Real attacks often combine chosen input with a secret token, cookie, or protocol field and measure ciphertext length, packet size, or response size. Defenders reduce the risk by separating secrets from attacker input, disabling compression on sensitive channels, or ensuring each stream has independent compression state. In practice, the best fix is to avoid sharing compression context across trust boundaries.