Live › vulnerability › CVE-2026-116773
Go to dashboardThe russh Rust SSH library's client accepts repeated packets using a private message number 7 before authentication and stores every extension name without a limit. A malicious SSH server can make a connecting client grow in memory for the lifetime of the session until it runs out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:29 UTC. All times on this page are UTC.
Only applications that use russh as an SSH client and connect to servers that may be untrusted or attacker-controlled. Services that only run russh as an SSH server, or that connect exclusively to trusted hosts, are less exposed. unknown whether the server-side code path is affected.
No product ranges from the sources yet.
Cargo.lock with grep -A1 'name = "russh"' Cargo.lock0.65.0 in your dependency tree with cargo tree -i russh0.65.0 or later with cargo update -p russhEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-116773")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.