CVE-2026-48110

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48110
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48110.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48110
Aliases
Downstream
Published
2026-06-10T20:26:29.994Z
Modified
2026-07-25T03:56:16.125577828Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds
Details

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48110.json"
}
References

Affected packages

Git / github.com/eugeny/russh

Affected ranges

Type
GIT
Repo
https://github.com/eugeny/russh
Events
Introduced
430c1ceacf8b357c985581ecdac0663bcee4ace1
Fixed
1947d6b1bb3a9d79840b5adf7eb9b33df2c6e4a7
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0.34.0"
        },
        {
            "fixed": "0.61.0"
        },
        {
            "introduced": "0"
        }
    ]
}

Affected versions

0.*
0.37.0-beta.1
v0.*
v0.34.0
v0.35.0-beta.1
v0.35.0-beta.2
v0.35.0-beta.3
v0.35.0-beta.5
v0.35.0-beta.6
v0.35.0-beta.7
v0.35.0-beta.8
v0.35.0-beta.9
v0.36.1
v0.37.0
v0.37.0-beta.1
v0.37.1
v0.38.0
v0.38.0-beta.1
v0.39.0-beta.1
v0.40.0
v0.40.1
v0.40.2
v0.42.0
v0.43.0
v0.43.0-beta.1
v0.44.0
v0.44.0-beta.1
v0.44.0-beta.3
v0.44.0-beta.4
v0.45.0
v0.46.0
v0.47.0-beta.3
v0.47.0-beta.4
v0.48.0
v0.48.1
v0.48.2
v0.49.0
v0.50.0
v0.50.0-beta.10
v0.50.0-beta.11
v0.50.0-beta.12
v0.50.0-beta.2
v0.50.0-beta.3
v0.50.0-beta.4
v0.50.0-beta.5
v0.50.0-beta.6
v0.50.0-beta.7
v0.50.0-beta.8
v0.50.0-beta.9
v0.50.1
v0.50.3
v0.50.4
v0.51.0
v0.51.0-beta.1
v0.51.0-beta.2
v0.51.0-beta.3
v0.51.1
v0.52.0
v0.52.0-beta.1
v0.52.1
v0.53.0
v0.53.0-beta.1
v0.54.0
v0.54.1
v0.54.2
v0.54.3
v0.54.4
v0.54.5
v0.54.6
v0.55.0
v0.56.0
v0.57.0
v0.57.1
v0.58.0
v0.59.0
v0.60.0
v0.60.1
v0.60.2
v0.60.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48110.json"