RUSTSEC-2026-0494

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0494

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0494.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0494

Aliases

Published

2026-06-11T12:00:00Z

Modified

2026-11-12T08:00:03Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

SSH message fields allocated before their size is checked

Details

Many of russh's client and server message handlers decoded length-prefixed strings, byte fields and name-lists from the peer into owned String, Vec or name-list values first and only checked their size and meaning afterwards. This includes the algorithm name-lists in SSH_MSG_KEXINIT, which a server parses during the initial key exchange, before any authentication.

A peer can fill these fields with oversized or highly fragmented values, for example a name-list of hundreds of thousands of one-letter algorithm names, and make russh allocate far more memory than the packet itself takes. With many concurrent connections this can exhaust the memory of a server process.

From 0.61.0, name-lists are rejected before they are split into separate strings when they are longer than 16 KiB or hold more than 1,024 entries, and the key exchange decodes its algorithm lists through this bounded decoder.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / russh

Package

Name: russh; View open source insights on deps.dev
Purl: pkg:cargo/russh

Affected ranges

Type: SEMVER
Events: Introduced

0.34.0

Fixed

0.61.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}