CVE-2026-116696
CVE-2026-116696 · russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
This page contains facts from public vulnerability sources. Check the original advisory before updating.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.
CVSS 3.3 · Low · EPSS 0.1%
- Published
- Updated
Stack: system
Affected products and versions
russh
- Versions
- < 0.65.0: Affected
No fix published
rust-russh Debian:14
- Versions
- 0.57.1-1
- 0.57.1-2
- 0.64.1-1
- 0.64.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-russh Ubuntu:26.10
- Versions
- 0.57.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published