CVE-2026-116773 Details
Description
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.
A denial-of-service vulnerability has been identified in the russh SSH client library, prior to version 0.65.0. The issue arises in the Session::process_packet function, where the client accepts repeated EXT_INFO packets encoded with russh's private message number 7, before authentication. This handling allows a malicious SSH server to send an unlimited number of attacker-controlled extension names, leading to excessive memory consumption. The vulnerability exists because the EXT_INFO message is not properly validated or bounded before being processed, allowing for exploitation over the lifetime of the session.
Users can upgrade to russh version 0.65.0, which addresses the vulnerability by limiting the number of EXT_INFO messages accepted before authentication and aligning the EXT_INFO message number with RFC 8308 standards.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75 | [email protected] | Source CodeVendor |
| https://github.com/Eugeny/russh/releases/tag/v0.65.0 | [email protected] | Release NotesVendor |
| https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eugeny russh | < 0.65 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |