p PatchFirst

CVE-2026-48110

CVE-2026-48110 · Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.

CVSS 7.5 · Élevée · EPSS 0,4% · Correctif disponible

Publication
Mise à jour

Pile logicielle: system

Produits et versions concernés

  • russh

    Versions du logiciel
    • >= 0.34.0, < 0.61.0: Concernée

    Aucun correctif publié

  • rust-russh Debian:14

    Versions du logiciel
    • 0.57.1-1
    • 0.57.1-2
    Plages de versions concernées
    • ECOSYSTEM: < 0.64.1-1

    Mettez à jour vers 0.64.1-1

Sources originales

Vérifiez votre serveur →