Is CVE-2026-102821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102821 being exploited in the wild.

How severe is CVE-2026-102821?

Medium severity, with a CVSS score of 6.5, published 29 September 2026.

Which products and versions are affected?

russh (crates.io) <= 0.63.1, SEMVER:introduced=0,fixed=0.63.2; Eugeny Russh before 0.63.2.

Is there a fix for CVE-2026-102821?

Yes. russh (crates.io): upgrade to 0.63.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102821 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102821?

Check whether you run russh (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102821: Russh SSH library unbounded memory allocation during rekey

Q: Which products and versions are affected?

russh (crates.io) <= 0.63.1, SEMVER:introduced=0,fixed=0.63.2; Eugeny Russh before 0.63.2.

Q: Is there a fix for CVE-2026-102821?

Yes. russh (crates.io): upgrade to 0.63.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102821 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102821?

Check whether you run russh (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102821 · Severity: medium · CVSS 6.5 · Published 2026-09-29

Russh is a Rust SSH client and server library used to implement SSH communication. An authenticated remote peer can trigger unbounded memory allocation on servers during the key exchange (rekey) phase by sending malformed SSH protocol messages, causing the process to consume memory until it crashes. This allows a legitimate SSH user to cause a denial of service.

Technologies: russh (crates.io), Eugeny Russh. Vendors: crates.io, Eugeny.

Quick answers

Is CVE-2026-102821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102821 being exploited in the wild.
How severe is CVE-2026-102821?: Medium severity, with a CVSS score of 6.5, published 29 September 2026.
Which products and versions are affected?: russh (crates.io) <= 0.63.1, SEMVER:introduced=0,fixed=0.63.2; Eugeny Russh before 0.63.2.
Is there a fix for CVE-2026-102821?: Yes. russh (crates.io): upgrade to 0.63.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102821 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102821?: Check whether you run russh (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

russh (crates.io): upgrade to 0.63.2 or later
```
cargo update -p russh
```

Technical details

An authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages. The SessionKexState::InProgress state prevents the priority_receiver queue in russh/src/server/session.rs from being drained, causing the server to enqueue unbounded ChannelOpenReply messages on an unbounded channel, leading to memory exhaustion. The fix validates that the peer's KEXINIT has been received before processing channel operations.

Affected products

Eugeny Russh before 0.63.2

Identifiers

CVE-2026-102821
GHSA-35g8-35p8-c8fw

Timeline

2026-09-29: disclosed
2026-09-09: patched: Fixed in version 0.63.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.