RUSTSEC-2026-0496

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0496

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0496.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0496

Aliases

Published

2026-04-24T12:00:00Z

Modified

2026-11-12T08:00:04Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Pre-authentication allocation from the keyboard-interactive response count

Details

A server that answers a keyboard-interactive authentication request with prompts (Auth::Partial, as a TOTP or other second-factor login does) then parses the client's SSH_MSG_USERAUTH_INFO_RESPONSE. russh read the number of responses from that message and reserved a vector of that many entries before reading any of them. A client that has not authenticated can send a very large count in a packet that carries no responses at all, and the server tries to allocate several gigabytes and may be killed for running out of memory.

Servers whose handler keeps the default behaviour, which rejects keyboard-interactive authentication, are not affected. From 0.60.1 the count is limited by how many responses the remaining packet data could actually hold.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / russh

Package

Name: russh; View open source insights on deps.dev
Purl: pkg:cargo/russh

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.60.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}