CVE-2026-46702 Details
Description
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path. In older releases before 0.58.0, the same remote decompression path used CryptoVec, which appears to make the historical impact worse. This issue has been patched in version 0.61.1.
A denial-of-service vulnerability has been identified in the Russh SSH client and server library, specifically in versions 0.34.0 prior to 0.61.1. When SSH compression is enabled, Russh improperly handled compressed packets that exceeded normal transport packet-length checks but decompressed to a much larger size. This flaw allowed a remote peer to send oversized packets post-decompression, causing resource exhaustion in the packet processing path. The issue is particularly severe in versions prior to 0.58.0, where the decompression path used CryptoVec, potentially amplifying the impact by aborting the process under constrained memory conditions.
Users can update to Russh version 0.61.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eugeny russh | >= 0.34.0, < 0.61.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |