CVE-2026-46673: Eugeny Russh denial of service via unchecked CryptoVec allocation

CVE-2026-46673 · Severity: high · CVSS 7.5 · Published 2026-06-10

Russh is a library used by developers to build SSH clients and servers in the Rust programming language. A vulnerability in how the library handles memory allocation allows attackers to trigger excessive memory usage, potentially crashing the application. In current versions, this can be triggered by local users interacting with an SSH agent, while older versions were susceptible to attacks from remote users over the network.

Technologies: russh (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-46673 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46673 being exploited in the wild.
How severe is CVE-2026-46673?
High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?
russh (crates.io) SEMVER:introduced=0,fixed=0.60.3, SEMVER:introduced=0.0.0-0,fixed=0.60.3; russh-cryptovec (crates.io) <= 0.60.2, SEMVER:introduced=0,fixed=0.60.3, SEMVER:introduced=0.0.0-0,fixed=0.60.3.
Is there a fix for CVE-2026-46673?
Yes. russh (crates.io): upgrade to 0.60.3 or later; russh-cryptovec (crates.io): upgrade to 0.60.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46673 attacked?
It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-46673?
Check whether you run russh (crates.io) or russh-cryptovec (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • russh (crates.io): upgrade to 0.60.3 or later
    cargo update -p russh
  • russh-cryptovec (crates.io): upgrade to 0.60.3 or later
    cargo update -p russh-cryptovec

Technical details

The vulnerability exists in the CryptoVec component of the russh library due to unchecked capacity growth, unchecked length arithmetic, and unsafe allocation paths. In versions 0.60.x, local SSH agent peers can provide attacker-controlled frame lengths that trigger buffer resizing before validation. In versions prior to 0.58.0, the issue was more severe as it was reachable via remote SSH traffic through transport and compression buffers. An attacker can exploit this to cause a process abort or Denial of Service (DoS) by forcing the application to allocate memory beyond available limits or triggering null-pointer validation failures in unsafe OS-call paths (mlock/munlock). The issue is fixed in version 0.60.3 by implementing checked arithmetic and capping agent frame lengths.

Affected products

  • Eugeny russh < 0.60.3
  • Eugeny russh-cryptovec < 0.60.3

Identifiers

  • CVE-2026-46673
  • GHSA-g9f8-wqj9-fjw5
  • RUSTSEC-2026-0153
  • RUSTSEC-2026-0154

Timeline

  • 2026-05-15: advisory: GitHub Security Advisory published
  • 2026-06-10: disclosed: CVE-2026-46673 published to NVD
  • 2026-06-10: patched: Fix released in version 0.60.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.