CVE-2026-46673

Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases

State: Published
Severity: 7.5 High
Published: Jun 10, 2026
Updated: Jun 11, 2026
Reserved: May 15, 2026

Read the record on cve.org

Description

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
russhEugeny	< 0.60.3Affected

References

https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.