{"id":"CVE-2026-116773","kind":"vulnerability","aliases":["CVE-2026-116773"],"related":[],"title":"russh: malicious SSH server can exhaust client memory before authentication","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.","summary":"The russh Rust SSH library's client accepts repeated packets using a private message number 7 before authentication and stores every extension name without a limit. A malicious SSH server can make a connecting client grow in memory for the lifetime of the session until it runs out.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","russh","rust","ssh-client"],"not_affected_if":["server-only-use","trusted-hosts-only"],"how_to_check":"- Check the russh version in `Cargo.lock` with `grep -A1 'name = \"russh\"' Cargo.lock`\n- Look for any version below `0.65.0` in your dependency tree with `cargo tree -i russh`","fix":"- Upgrade the russh crate to `0.65.0` or later with `cargo update -p russh`","status":"open","published_at":"2026-10-27T21:18:05+00:00","first_seen_at":"2026-10-27T21:29:21+00:00","triaged_at":"2026-10-27T21:30:22+00:00","updated_at":"2026-10-27T21:30:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T21:30:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the russh crate to `0.65.0` or later with `cargo update -p russh`","reach":"network","title":"russh: malicious SSH server can exhaust client memory before authentication","impact":"low","summary":"The russh Rust SSH library's client accepts repeated packets using a private message number 7 before authentication and stores every extension name without a limit. A malicious SSH server can make a connecting client grow in memory for the lifetime of the session until it runs out.","category":"package","nicknames":[],"who_cares":["rust","russh","ssh-client"],"confidence":0.7,"needs_auth":"no","worst_case":"Client process memory grows until exhausted, causing denial of service","analyst_note":"","how_to_check":"- Check the russh version in `Cargo.lock` with `grep -A1 'name = \"russh\"' Cargo.lock`\n- Look for any version below `0.65.0` in your dependency tree with `cargo tree -i russh`","needs_analyst":false,"not_affected_if":["server-only-use","trusted-hosts-only"],"who_is_affected":"Only applications that use russh as an SSH client and connect to servers that may be untrusted or attacker-controlled. Services that only run russh as an SSH server, or that connect exclusively to trusted hosts, are less exposed. unknown whether the server-side code path is affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3465,"output_tokens":499,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116773':13A,16A '-2026':12A,15A '0.65.0':88C,185C '7':38B,108C,157C '82':120C 'accept':30B,97C 'affect':125C 'agent':83C 'append':132C 'attack':166C 'attacker-control':165C 'authent':10A,40B,110C 'bound':144C 'caus':174C 'clear':141C 'client':7A,22B,29B,57B,75C,90C,176C 'compliant':115C 'connect':56B 'control':167C 'cve':11A,14A 'dedupl':142C 'deliber':152C 'encod':100C 'everi':43B,133C 'exhaust':6A,178C 'ext':106C,116C,129C 'extens':44B,135C,139C,168C 'fix':182C 'function':131C 'grow':58B 'handl':128C 'handler':126C 'implement':85C 'includ':80C 'info':107C,117C,130C 'issu':180C 'librari':27B,78C 'lifetim':63B,173C 'limit':48B 'make':54B 'malici':2A,50B,148C 'memori':8A,60B,177C 'messag':36B,118C,155C 'msg':105C 'name':45B,136C,169C 'number':37B,119C,156C,163C 'packag':17B 'packet':32B,93C,99C 'pars':134C 'path':94C 'prior':86C 'privat':35B,104C,154C 'process':92C 'progress':175C 'protocol':84C 'reach':123C 'receiv':138C 'repeat':31B,98C 'retain':160C 'run':69B 'russh':1A,18B,24B,70C,102C 'russh/src/client/encrypted.rs':96C 'rust':19B,25B,73C 'send':153C 'server':4A,52B,77C,150C 'session':66B,91C,172C 'ssh':3A,21B,26B,51B,74C,82C,149C 'ssh-client':20B 'standard':114C 'standards-compli':113C 'store':42B 'therefor':159C 'unbound':162C 'use':33B 'vector':146C 'version':184C 'without':46B,140C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use russh as an SSH client and connect to servers that may be untrusted or attacker-controlled. Services that only run russh as an SSH server, or that connect exclusively to trusted hosts, are less exposed. unknown whether the server-side code path is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T21:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116773","severity":null,"published_at":"2026-10-27T21:18:05+00:00","modified_at":"2026-10-27T21:18:05+00:00","first_seen_at":"2026-10-27T21:29:21+00:00","fetched_at":"2026-10-27T21:29:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}