Live › vulnerability › CVE-2026-116775
Go to dashboardThe pageant Rust crate's PageantStream trusts a four-byte length prefix sent by the peer and buffers until that many bytes arrive, without checking the fixed agent message size limit. A malicious SSH server reached through a forwarded-agent bridge can force large allocations or hold partial frames, exhausting client memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:29 UTC. All times on this page are UTC.
Only applications that use pageant's PageantStream to bridge an SSH forwarded-agent channel to a raw stream are described as affected, and the flaw applies to versions from 0.2.0 through 0.2.5. Teams that do not depend on the pageant crate, or that run only versions outside that range, can skip it. The sources do not say whether other bridge code paths are exposed.
No product ranges from the sources yet.
cargo tree -i pageant in the project to see whether the pageant crate is present and which version is resolved.pageant entry with a version between 0.2.0 and 0.2.4.0.2.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-116775")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.