Is CVE-2026-116774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116774 being exploited in the wild.

How severe is CVE-2026-116774?

Medium severity, with a CVSS score of 4.3, published 27 October 2026.

Which products and versions are affected?

russh (crates.io) >= 0.60.0, <= 0.64.1, ECOSYSTEM:introduced=0.60.0,fixed=0.65; Russh 0.60.0 to 0.64.x.

Is there a fix for CVE-2026-116774?

Yes. russh (crates.io): upgrade to 0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116774 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116774?

Check whether you run russh (crates.io) or Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116774: russh SSH library zero maximum packet size denial of service

Q: Is there a fix for CVE-2026-116774?

Yes. russh (crates.io): upgrade to 0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116774 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-116774?

Check whether you run russh (crates.io) or Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116774 · Severity: medium · CVSS 4.3 · Published 2026-10-27

russh is a Rust SSH client and server library used in applications that need SSH functionality. An attacker can exploit a flaw in how the library handles SSH channel setup by declaring a zero-sized maximum packet, causing the affected application's write operations to hang indefinitely. This allows an authenticated attacker against a server, or any attacker against a client connecting to a malicious server, to cause a denial of service by stranding channels and connections without an error notification.

Technologies: russh (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-116774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116774 being exploited in the wild.
How severe is CVE-2026-116774?: Medium severity, with a CVSS score of 4.3, published 27 October 2026.
Which products and versions are affected?: russh (crates.io) >= 0.60.0, <= 0.64.1, ECOSYSTEM:introduced=0.60.0,fixed=0.65; Russh 0.60.0 to 0.64.x.
Is there a fix for CVE-2026-116774?: Yes. russh (crates.io): upgrade to 0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116774 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116774?: Check whether you run russh (crates.io) or Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

russh (crates.io): upgrade to 0.65 or later
```
cargo update -p russh
```

Technical details

The vulnerability exists in channel-open packet parsing (versions 0.60.0 to 0.64.x) where a peer-declared maximum_packet_size of zero is accepted and passed to ChannelTx::poll_writable. The asynchronous write paths (Channel::data, Channel::make_writer, Channel::into_stream) calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. The fix in 0.65.0 rejects zero-valued maximum_packet_size parameters at the protocol parsing stage.

Affected products

russh russh 0.60.0 to 0.64.x

Identifiers

CVE-2026-116774
GHSA-fw5c-8223-6h42

Timeline

2026-10-27: disclosed
2026-10-25: patched: Version 0.65.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.