CVE-2026-46673
CVE-2026-46673 · Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
CVSS 7.5 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
russh
- Versiones
- < 0.60.3: Afectada
Sin corrección publicada
rust-russh Debian:14
- Versiones
- 0.57.1-1
- 0.57.1-2
- Intervalos de versiones afectados
- ECOSYSTEM: < 0.64.1-1
Actualiza a 0.64.1-1
rust-russh-cryptovec Debian:14
- Versiones
- 0.52.0-1
- 0.58.0-1
- 0.59.0-1
- Intervalos de versiones afectados
- ECOSYSTEM: < 0.62.0-1
Actualiza a 0.62.0-1