CVE-2026-46673 Details
Description
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
A vulnerability in the Russh SSH client and server library for Rust, prior to version 0.60.3, involves unchecked capacity growth and length arithmetic in the CryptoVec component, leading to unsafe memory management. In current releases, local SSH agent inputs could manipulate frame lengths, causing unvalidated buffer growth. In versions before 0.58.0, remote SSH traffic also exploited this flaw through transport and compression buffers, allowing for similar unchecked growth. The vulnerability has been patched in version 0.60.3.
Users can update to Russh version 0.60.3, which addresses the vulnerability by implementing checked capacity growth and length arithmetic in CryptoVec, along with proper handling of allocation failures and zero-length locking calls. The update also caps agent frame lengths to prevent oversized inputs from causing unchecked buffer growth.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eugeny russh | <= 0.60.2 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |