CVE-2026-111061: russh SSH agent unbounded memory allocation via constraint records

CVE-2026-111061 · Severity: medium · CVSS 4.3 · Published 2026-10-19

russh is a Rust SSH client and server library with an SSH agent protocol implementation used by SSH clients and servers to manage cryptographic keys. An attacker who can communicate with the SSH agent locally or through agent forwarding can craft malicious constraint messages that cause the agent to allocate unlimited memory and spawn excessive tasks, leading to denial of service where the agent becomes unavailable.

Technologies: russh (crates.io), Eugeny Russh. Vendors: crates.io, Eugeny.

Quick answers

Is CVE-2026-111061 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111061 being exploited in the wild.
How severe is CVE-2026-111061?
Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?
russh (crates.io) <= 0.64.0, SEMVER:introduced=0,fixed=0.64.1; Eugeny Russh prior to 0.64.1.
Is there a fix for CVE-2026-111061?
Yes. russh (crates.io): upgrade to 0.64.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111061 attacked?
It is attacked with local access or from the adjacent network, in a software library.
Am I affected by CVE-2026-111061?
Check whether you run russh (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • russh (crates.io): upgrade to 0.64.1 or later
    cargo update -p russh

Technical details

The vulnerability exists in the agent protocol handler prior to version 0.64.1, where the server spawns a separate long-lived tokio task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request without enforcing limits. The parsing loop does not roll back previously spawned tasks when later constraint parsing fails, allowing an attacker to exhaust memory and task resources. An attacker with local access or forwarded agent connection can trigger this condition with a crafted message.

Affected products

  • Eugeny russh prior to 0.64.1

Identifiers

  • CVE-2026-111061
  • GHSA-4wc5-f2rc-q74m

Timeline

  • 2026-10-19: disclosed
  • 2026-10-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.