{"id":"EUVD-2026-36124","revision":"e7e82c1dcf5e429db8108a66e1cca7b2","records":[{"revision":"e7e82c1dcf5e429db8108a66e1cca7b2","observedAt":"2026-11-07T10:39:13.184+00:00","statement":{"source":"euvd","id":"EUVD-2026-36124","aliases":["CVE-2026-46673","GHSA-g9f8-wqj9-fjw5"],"title":"Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still f…","description":"Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36124","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 10, 2026, 8:16:28 PM","dateUpdated":"Jun 11, 2026, 2:33:14 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36124","identifiers":["EUVD-2026-36124","CVE-2026-46673","GHSA-g9f8-wqj9-fjw5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}