CVE-2026-46702

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46702", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T23:26:58.308Z", "datePublished": "2026-06-10T20:19:18.792Z", "dateUpdated": "2026-06-11T16:15:30.354Z"}, "containers": {"cna": {"title": "Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": ">= 0.34.0, < 0.61.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T20:19:18.792Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path. In older releases before 0.58.0, the same remote decompression path used CryptoVec, which appears to make the historical impact worse. This issue has been patched in version 0.61.1."}], "source": {"advisory": "GHSA-wwx6-x28x-8259", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T12:30:06.205533Z", "id": "CVE-2026-46702", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T16:15:30.354Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46702", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T12:30:06.205533Z"}}}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T12:30:15.869Z"}}], "cna": {"title": "Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets", "source": {"advisory": "GHSA-wwx6-x28x-8259", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": ">= 0.34.0, < 0.61.1"}]}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259", "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path. In older releases before 0.58.0, the same remote decompression path used CryptoVec, which appears to make the historical impact worse. This issue has been patched in version 0.61.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T20:19:18.792Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46702", "state": "PUBLISHED", "dateUpdated": "2026-06-11T16:15:30.354Z", "dateReserved": "2026-05-15T23:26:58.308Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-10T20:19:18.792Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": ">= 0.34.0, < 0.61.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path. In older releases before 0.58.0, the same remote decompression path used CryptoVec, which appears to make the historical impact worse. This issue has been patched in version 0.61.1."}, {"lang": "es", "value": "Russh es una biblioteca de cliente y servidor SSH de Rust. Desde la versi\u00f3n 0.34.0 hasta antes de la versi\u00f3n 0.61.1, cuando la compresi\u00f3n SSH est\u00e1 habilitada, russh aceptaba paquetes comprimidos cuyo tama\u00f1o en la red pasaba las comprobaciones normales de longitud de paquete de transporte, pero cuyo tama\u00f1o descomprimido era mucho mayor. Esto permit\u00eda a un par remoto enviar paquetes post-descompresi\u00f3n de tama\u00f1o excesivo que deber\u00edan haber sido rechazados. En las versiones actuales, esto es un problema de denegaci\u00f3n de servicio remota / agotamiento de recursos en la ruta de recepci\u00f3n post-descompresi\u00f3n. En versiones anteriores a la 0.58.0, la misma ruta de descompresi\u00f3n remota utilizaba CryptoVec, lo que parece empeorar el impacto hist\u00f3rico. Este problema ha sido parcheado en la versi\u00f3n 0.61.1."}], "id": "CVE-2026-46702", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46702", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T12:30:06.205533Z", "version": "2.0.3"}}]}, "published": "2026-06-10T22:17:00.580", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.34.0,0.61.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "russh", "source": "cna", "vendor": "Eugeny"}, "product": "russh", "vendor": "eugeny"}], "created": "2026-06-10T22:45:27.366794+00:00", "updated": "2026-06-10T23:00:20.875437+00:00", "vendors": ["eugeny", "eugeny$PRODUCT$russh"]}