EUVD-2026-111388Published
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-116773 · CVE overview and exploitation status
cve-program · CVE-2026-116773
- https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg
- https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75
- https://github.com/Eugeny/russh/releases/tag/v0.65.0
euvd · EUVD-2026-111388
- https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg
- https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75
- https://github.com/Eugeny/russh/releases/tag/v0.65.0
nvd · CVE-2026-116773
- https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75
- https://github.com/Eugeny/russh/releases/tag/v0.65.0
- https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg
osv · GHSA-4p9f-7p9m-5vfg
Related changes
Linked by CVE identifier- russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's privat… · Advisory content revised · 6 Nov 2026
- russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's privat… · Advisory content revised · 1 Nov 2026
- russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets · Newly collected advisory · 30 Oct 2026