Executive brief
Russh is a library used by developers to build SSH clients and servers in the Rust programming language. A vulnerability in how the library handles memory allocation allows attackers to trigger excessive memory usage, potentially crashing the application. In current versions, this can be triggered by local users interacting with an SSH agent, while older versions were susceptible to attacks from remote users over the network.
Technical details
The vulnerability exists in the CryptoVec component of the russh library due to unchecked capacity growth, unchecked length arithmetic, and unsafe allocation paths. In versions 0.60.x, local SSH agent peers can provide attacker-controlled frame lengths that trigger buffer resizing before validation. In versions prior to 0.58.0, the issue was more severe as it was reachable via remote SSH traffic through transport and compression buffers. An attacker can exploit this to cause a process abort or Denial of Service (DoS) by forcing the application to allocate memory beyond available limits or triggering null-pointer validation failures in unsafe OS-call paths (mlock/munlock). The issue is fixed in version 0.60.3 by implementing checked arithmetic and capping agent frame lengths.
Affected products
- Eugeny russh < 0.60.3
- Eugeny russh-cryptovec < 0.60.3
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-46673 published to NVD
- 2026-06-10: patched: Fix released in version 0.60.3