{"id":"RUSTSEC-2026-0153","revision":"c17db6acf21741f8ab43382ed3c9b686","records":[{"revision":"c17db6acf21741f8ab43382ed3c9b686","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0153","aliases":["CVE-2026-46673","GHSA-g9f8-wqj9-fjw5","RUSTSEC-2026-0154"],"title":"Unchecked `CryptoVec` allocation and growth handling","description":"`CryptoVec` used unchecked capacity growth, unchecked length arithmetic, and\nunsafe allocation and locking paths. In affected `russh` releases,\nattacker-controlled input could reach these code paths through buffer resizing\noperations.\n\nTwo affected reachability paths were identified:\n\n* **Current `russh` releases (`0.60.x` before the fix)**\n  Local SSH agent peers could provide attacker-controlled frame lengths that\n  were used to resize internal buffers before validation in:\n\n  * `AgentClient::read_response`\n  * `agent::server::Connection::run`\n\n* **Historical `russh` releases before `0.58.0`**\n  `CryptoVec` was also used for non-secret transport and compression buffers,\n  allowing remote SSH traffic to trigger `CryptoVec` growth through:\n\n  * transport packet reads\n  * zlib decompression output\n\nThese remote paths were removed in `0.58.0` when `CryptoVec` stopped being used\nfor those buffers.\n\nUnder constrained memory conditions, historical `russh` versions prior to\n`0.58.0` can abort the process when remote compressed payload expansion causes\nallocation failure in `CryptoVec`. This was reproduced through the compression\npath and resulted in process termination in the Unix allocation/locking\nimplementation after null pointer allocation failure.\n\nFor current affected releases, oversized local SSH agent frame lengths could\ntrigger untrusted-input-driven buffer growth prior to validation.\n\nNo practical remote code execution, integrity or confidentiality impact has\nbeen demonstrated.\n\nFixed by validating CryptoVec growth operations and rejecting oversized SSH\nagent frame lengths before buffer allocation.","state":0,"publishedAt":"2026-05-15T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:09.2378542+00:00","affected":[{"ecosystem":"crates.io","name":"russh-cryptovec","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.60.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/russh-cryptovec","https://rustsec.org/advisories/RUSTSEC-2026-0153.html","https://github.com/Eugeny/russh/commit/a2d48a71fe93d18cbd666c8d53d0882f5ce110c4"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0153","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0153","identifiers":["RUSTSEC-2026-0153","CVE-2026-46673","GHSA-g9f8-wqj9-fjw5","RUSTSEC-2026-0154"]},"retained":false,"historicalAffected":[]}],"coverage":[]}