Is CVE-2026-116775 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116775 being exploited in the wild.

How severe is CVE-2026-116775?

Medium severity, with a CVSS score of 4, published 27 October 2026.

Which products and versions are affected?

pageant (crates.io) >= 0.2.0, <= 0.2.4, SEMVER:introduced=0.2.0,fixed=0.2.5; Eugeny Russh 0.2.0 to 0.2.5.

Is there a fix for CVE-2026-116775?

Yes. pageant (crates.io): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116775 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116775?

Check whether you run pageant (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116775: pageant PageantStream unbounded frame buffering

Q: Is there a fix for CVE-2026-116775?

Yes. pageant (crates.io): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116775 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116775?

Check whether you run pageant (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116775 · Severity: medium · CVSS 4 · Published 2026-10-27

The pageant library, used to communicate with SSH agent instances, does not validate message size limits before buffering data. A malicious SSH agent server can send oversized messages that cause the client to exhaust memory through large allocations or retain incomplete frames, potentially denying service to applications using this library.

Technologies: Eugeny Russh. Vendors: crates.io, Eugeny.

Quick answers

Is CVE-2026-116775 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116775 being exploited in the wild.
How severe is CVE-2026-116775?: Medium severity, with a CVSS score of 4, published 27 October 2026.
Which products and versions are affected?: pageant (crates.io) >= 0.2.0, <= 0.2.4, SEMVER:introduced=0.2.0,fixed=0.2.5; Eugeny Russh 0.2.0 to 0.2.5.
Is there a fix for CVE-2026-116775?: Yes. pageant (crates.io): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116775 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116775?: Check whether you run pageant (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pageant (crates.io): upgrade to 0.2.5 or later
```
cargo update -p pageant
```

Technical details

PageantStream::new trusts a peer-controlled 4-byte length prefix and buffers message data without enforcing the _AGENT_MAX_MSGLEN transport capacity limit. An attacker can declare a frame size larger than this limit, triggering unbounded memory allocation. Exploitation requires the application to bridge an SSH forwarded-agent channel to the raw pageant stream, allowing server-side control of the length prefix.

Affected products

Eugeny russh 0.2.0 to 0.2.5

Identifiers

CVE-2026-116775
GHSA-662x-8wvj-2276

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.