CVE-2026-46673 - Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases

Back Back to CVE browser

HIGH

Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases

Published Jun 10, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.46%

Description

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.

Affected products

Vendor Eugeny Product Russh Default
n/a
- Version
  < 0.60.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Eugeny

Russh

n/a

Version	Status	Constraints
< 0.60.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (5)

Link	Providers	Tags
https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5		exploitx_refsource_CONFIRM
https://github.com/advisories/GHSA-g9f8-wqj9-fjw5		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46673
https://rustsec.org/advisories/RUSTSEC-2026-0153.html
https://rustsec.org/advisories/RUSTSEC-2026-0154.html