CVE-2026-111061Published
russh agent server converts constraint records into unbounded never-rolled-back tasks
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111061 · Microsoft / collected KEV context
cve-program · CVE-2026-111061
- https://github.com/Eugeny/russh/security/advisories/GHSA-4wc5-f2rc-q74m
- https://github.com/Eugeny/russh/commit/4c305033d72f8e5dd21a3fd4c53a6c291a16ebd1
- https://github.com/Eugeny/russh/releases/tag/v0.64.1
euvd · EUVD-2026-104457
- https://github.com/Eugeny/russh/security/advisories/GHSA-4wc5-f2rc-q74m
- https://github.com/Eugeny/russh/commit/4c305033d72f8e5dd21a3fd4c53a6c291a16ebd1
- https://github.com/Eugeny/russh/releases/tag/v0.64.1
nvd · CVE-2026-111061
- https://github.com/Eugeny/russh/commit/4c305033d72f8e5dd21a3fd4c53a6c291a16ebd1
- https://github.com/Eugeny/russh/releases/tag/v0.64.1
- https://github.com/Eugeny/russh/security/advisories/GHSA-4wc5-f2rc-q74m
osv · GHSA-4wc5-f2rc-q74m
Related operational evidence
Explicit CVE identifiers- russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key req… · Advisory content revised · 5 Nov 2026
- russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key req… · Advisory content revised · 1 Nov 2026