Read the docs
TI-2026-81532 Aliases CVE-2026-116773GHSA-4p9f-7p9m-5vfg

Unbounded memory growth in russh SSH client via EXT_INFO packets

Priority MEDIUM 53CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

russh, a Rust SSH client and server library, is affected before 0.65.0. Before authentication, the client accepts repeated packets that use a private message number 7 and stores every extension name without a limit (CWE-770). A malicious SSH server can send these packets so that client memory use grows for the life of the session, and a user must connect to that server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix Fixed russh (Eugeny): 0.65.0russh (crates.io): 0.65Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eugenyrusshbefore 0.65.00.65.0Patch availableCNA
—russh (crates.io)before 0.650.65Patch availableGHSA-4p9f-7p9m-5vfg
  • russh VendorEugeny Affected before 0.65.0 Fixed in 0.65.0 Patch available CNA
  • russh (crates.io) Vendor— Affected before 0.65 Fixed in 0.65 Patch available GHSA-4p9f-7p9m-5vfg

Remediation

Upgrade russh to version 0.65.0 on Eugeny's release line, or to version 0.65 on crates.io. Red Hat Hardened Images RPMs are fixed by RHSA-2026:93904, released 2026-11-02.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA russh (Eugeny) Fixed in 0.65.0
  • Fix · GHSA-4p9f-7p9m-5vfg russh (crates.io) Fixed in 0.65 Advisory →

Red Hat 1 advisory

  • RHSA-2026:93904 Released 2026-11-02 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images openshell-0.1.6-0.1.hum1@aarch64, openshell-0.1.6-0.1.hum1@src, openshell-0.1.6-0.1.hum1@x86_64 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:93904

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-116773
  2. 2026-10-29 Affected versions changed · Red Hat
  3. 2026-10-29 CVSS score added · Red Hat
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: LOW → MEDIUM
  6. 2026-10-30 Alias added: GHSA-4p9f-7p9m-5vfg
  7. 2026-10-30 Fix available: crates.io/[email protected] · GHSA-4p9f-7p9m-5vfg
  8. 2026-10-30 CVSS score added · GHSA-4p9f-7p9m-5vfg
  9. 2026-10-30 Weakness changed · GHSA-4p9f-7p9m-5vfg
  10. 2026-10-30 5 new references · GHSA-4p9f-7p9m-5vfg
  11. 2026-11-03 Fix available: RHSA-2026:93904 · Red Hat
  12. 2026-11-03 Fix available: Red Hat Hardened Images · Red Hat

References

Advisory 1

Other 4

  • TI-2026-65512 russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened CVSS 3.1HIGH 7.5
  • TI-2026-35550 Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds CVSS 3.1HIGH 7.5
  • TI-2026-34331 Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets CVSS 3.1HIGH 7.5
  • TI-2026-34308 Resource allocation without limits in Eugeny russh CVSS 3.1HIGH 7.5
  • TI-2025-16084 Tabby has a TCC Bypass via Misconfigured Node Fuses CVSS 4.0HIGH 8.6
  • TI-2024-36991 Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby CVSS 4.0HIGH 8.6
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences