# CVE-2026-116775: pageant PageantStream unbounded frame buffering

Source: https://junglewise.ai/threats/cve-2026-116775-pageant-provides-a-pageantstream-type-that-implements-asyncread  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116775 · Severity: medium · CVSS 4 · Published 2026-10-27

The pageant library, used to communicate with SSH agent instances, does not validate message size limits before buffering data. A malicious SSH agent server can send oversized messages that cause the client to exhaust memory through large allocations or retain incomplete frames, potentially denying service to applications using this library.

Technologies: [Eugeny Russh](https://junglewise.ai/threats/technologies/eugeny-russh). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Eugeny](https://junglewise.ai/threats/vendors/eugeny).

## Quick answers

**Is CVE-2026-116775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116775 being exploited in the wild.

**How severe is CVE-2026-116775?** Medium severity, with a CVSS score of 4, published 27 October 2026.

**Which products and versions are affected?** pageant (crates.io) >= 0.2.0, <= 0.2.4, SEMVER:introduced=0.2.0,fixed=0.2.5; Eugeny Russh 0.2.0 to 0.2.5.

**Is there a fix for CVE-2026-116775?** Yes. pageant (crates.io): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116775 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116775?** Check whether you run pageant (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pageant (crates.io): upgrade to 0.2.5 or later

  ```sh
  cargo update -p pageant
  ```


## Technical details

PageantStream::new trusts a peer-controlled 4-byte length prefix and buffers message data without enforcing the _AGENT_MAX_MSGLEN transport capacity limit. An attacker can declare a frame size larger than this limit, triggering unbounded memory allocation. Exploitation requires the application to bridge an SSH forwarded-agent channel to the raw pageant stream, allowing server-side control of the length prefix.

## Affected products

- Eugeny russh 0.2.0 to 0.2.5

## Identifiers

- CVE-2026-116775
- GHSA-662x-8wvj-2276

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/Eugeny/russh/commit/69e4b55513eaa8ac9d2ad4236f13171fc164e10a](https://github.com/Eugeny/russh/commit/69e4b55513eaa8ac9d2ad4236f13171fc164e10a)
- [https://github.com/Eugeny/russh/releases/tag/v0.65.0](https://github.com/Eugeny/russh/releases/tag/v0.65.0)

## Related threats

- [russh SSH server signature algorithm mismatch in publickey auth](https://junglewise.ai/threats/cve-2026-111062-a-russh-ssh-server-accepts-a-publickey-authentication-whose)
- [russh SSH agent confirmation bypass](https://junglewise.ai/threats/cve-2026-116794-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh SSH agent unbounded memory allocation via constraint records](https://junglewise.ai/threats/cve-2026-111061-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [Russh hybrid ML-KEM key exchange validation bypass](https://junglewise.ai/threats/cve-2026-102824-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-0)
- [Russh SSH library unbounded memory allocation during rekey](https://junglewise.ai/threats/cve-2026-102821-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-2-an)