CVE-2026-102821

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102821", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T17:25:25.265Z", "datePublished": "2026-09-29T18:21:21.858Z", "dateUpdated": "2026-09-30T19:35:02.962Z"}, "containers": {"cna": {"title": "Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"}, {"name": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b"}, {"name": "https://github.com/Eugeny/russh/releases/tag/v0.63.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.2"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": "< 0.63.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T18:21:21.858Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2."}], "source": {"advisory": "GHSA-35g8-35p8-c8fw", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T19:34:47.748081Z", "id": "CVE-2026-102821", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:35:02.962Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102821", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T17:25:25.265Z", "datePublished": "2026-09-29T18:21:21.858Z", "dateUpdated": "2026-09-30T19:35:02.962Z"}, "containers": {"cna": {"title": "Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"}, {"name": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b"}, {"name": "https://github.com/Eugeny/russh/releases/tag/v0.63.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.2"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": "< 0.63.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T18:21:21.858Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2."}], "source": {"advisory": "GHSA-35g8-35p8-c8fw", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102821", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:34:47.748081Z"}}}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:34:58.922Z"}}]}}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": "< 0.63.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2."}], "id": "CVE-2026-102821", "lastModified": "2026-09-30T20:17:23.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102821", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T19:34:47.748081Z", "version": "2.0.3"}}]}, "published": "2026-09-29T19:17:23.993", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation", "id": "2543501", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543501"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service (DoS) by initiating a Secure Shell (SSH) key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the internal queue during the stalled key exchange, system memory is continuously consumed until the process terminates."], "name": "CVE-2026-102821", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-29T18:21:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102821\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102821\nhttps://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.2\nhttps://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.63.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "russh", "source": "cna", "vendor": "Eugeny"}, "product": "russh", "vendor": "eugeny"}], "created": "2026-09-29T21:30:08.563487+00:00", "updated": "2026-09-29T22:15:08.971008+00:00", "vendors": ["eugeny", "eugeny$PRODUCT$russh"]}