Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-116696: russh SSH library may exhaust memory via agent
CVE-2026-116696 · published 8 days ago
Summary
The russh SSH client/server library lets anyone who can talk to its agent add unlimited constraint records, causing the program’s memory use to keep growing. This can slow down or stop the service. Upgrade to version 0.65.0 or later to stop the memory growth.
What to do
- Update russh to version 0.65.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | eugeny | russh | < 0.65.0 |
| Debian:14 | debian | rust-russh | All versions |
| Ubuntu:26.10 | canonical | rust-russh | All versions |
| rust | – | russh |
< 0.65.0 Fix: upgrade to 0.65.0
|
Original advisory text
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1166... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-116696 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-116696 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-116696 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-116696 Third Party Advisory
- https://github.com/advisories/GHSA-9wfm-jcj8-jfv9
- https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9 Vendor Advisory
- https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6 Patch
- https://github.com/Eugeny/russh/releases/tag/v0.65.0 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published27 Oct 2026
Updated4 Nov 2026
First seen27 Oct 2026
Sources
CVE-2026-116696 · NVD
CVE-2026-116696 · MITRE
CVE-2026-116696 · OSV
GHSA-9wfm-jcj8-jfv9 · GHSA
DEBIAN-CVE-2026-116696 · OSV
UBUNTU-CVE-2026-116696 · OSV
Track software like this
Free during beta