CVE-2026-116773

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116773", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T21:53:35.165Z", "datePublished": "2026-10-27T20:23:25.559Z", "dateUpdated": "2026-10-30T15:17:49.289Z"}, "containers": {"cna": {"title": "russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg"}, {"name": "https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75"}, {"name": "https://github.com/Eugeny/russh/releases/tag/v0.65.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.0"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": "< 0.65.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T20:23:47.305Z"}, "descriptions": [{"lang": "en", "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0."}], "source": {"advisory": "GHSA-4p9f-7p9m-5vfg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:17:39.066575Z", "id": "CVE-2026-116773", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:17:49.289Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116773", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T15:17:39.066575Z"}}}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:17:24.401Z"}}], "cna": {"title": "russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets", "source": {"advisory": "GHSA-4p9f-7p9m-5vfg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": "< 0.65.0"}]}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg", "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75", "name": "https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Eugeny/russh/releases/tag/v0.65.0", "name": "https://github.com/Eugeny/russh/releases/tag/v0.65.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T20:23:47.305Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116773", "state": "PUBLISHED", "dateUpdated": "2026-10-30T15:17:49.289Z", "dateReserved": "2026-10-26T21:53:35.165Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T20:23:25.559Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": "< 0.65.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0."}], "id": "CVE-2026-116773", "lastModified": "2026-10-30T16:17:41.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116773", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:17:39.066575Z", "version": "2.0.3"}}]}, "published": "2026-10-27T21:18:05.780", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "id": "2562400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562400"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.", "A flaw was found in russh. An unbounded memory allocation issue allows a malicious Secure Shell (SSH) server to cause a Denial of Service (DoS) on connecting clients. By repeatedly sending crafted pre-authentication extension packets, the server forces the client to store an unlimited number of extension entries without clearing or deduplicating them. This behavior leads to progressive memory exhaustion and can crash the client process."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-116773", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-27T20:23:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116773\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116773\nhttps://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75\nhttps://github.com/Eugeny/russh/releases/tag/v0.65.0\nhttps://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg"], "statement": "This vulnerability is rated as Moderate because exploitation requires a client session to connect to an untrusted or rogue SSH server, limiting the impact to client-side resource exhaustion without compromising system confidentiality or integrity. Within Red Hat environments, core operating system services rely on OpenSSH, while russh is only embedded in specialized packages such as openshell. Typical system configurations and standard SSH daemon operations remain completely unaffected by this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.65.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "russh", "source": "cna", "vendor": "Eugeny"}, "product": "russh", "vendor": "eugeny"}], "created": "2026-10-27T21:45:08.301934+00:00", "updated": "2026-10-27T21:45:08.476807+00:00", "vendors": ["eugeny", "eugeny$PRODUCT$russh"]}