# CVE-2026-46702: Eugeny Russh denial of service via unbounded SSH decompression

Source: https://junglewise.ai/threats/cve-2026-46702-eugeny-russh-denial-of-service-via-unbounded-ssh-decompression  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46702 · Severity: high · CVSS 7.5 · Published 2026-06-10

Russh is a library used to build SSH clients and servers in the Rust programming language. A vulnerability in how it handles compressed data allows a remote attacker to send specially crafted packets that expand to an enormous size once opened. This can cause the application to consume excessive memory or crash, leading to a denial-of-service that disrupts secure communications.

Technologies: [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-46702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46702 being exploited in the wild.

**How severe is CVE-2026-46702?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** russh (crates.io) SEMVER:introduced=0.34.0,fixed=0.61.1.

**Is there a fix for CVE-2026-46702?** Yes. russh (crates.io): upgrade to 0.61.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46702 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46702?** Check whether you run russh (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- russh (crates.io): upgrade to 0.61.1 or later

  ```sh
  cargo update -p russh
  ```


## Technical details

A resource exhaustion vulnerability exists in russh's SSH decompression path (RFC 4253). While the library enforces packet-length limits on the encrypted/compressed wire data, it failed to enforce a separate ceiling on the post-decompression payload size. An attacker can craft a compressed SSH_MSG_DEBUG packet that stays under the 256 KiB transport cap but expands beyond 128 MiB after decompression. In versions prior to 0.58.0, the use of CryptoVec in this path could lead to process aborts; in later versions, it results in unbounded memory allocation (Vec<u8>). The issue is reachable unauthenticated if the server advertises zlib support, as negotiation follows the client's preference. Fixed in version 0.61.1 by implementing an explicit 128 MiB post-decompression limit.

## Affected products

- Eugeny russh >= 0.34.0, < 0.61.1

## Identifiers

- CVE-2026-46702
- GHSA-wwx6-x28x-8259

## Timeline

- 2026-05-23: advisory: GitHub Security Advisory published by maintainer
- 2026-06-10: disclosed: CVE published to NVD
- 2026-06-10: patched: Fix released in version 0.61.1

## References

- [https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259](https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259)

## Related threats

- [russh SSH server signature algorithm mismatch in publickey auth](https://junglewise.ai/threats/cve-2026-111062-a-russh-ssh-server-accepts-a-publickey-authentication-whose)
- [russh SSH agent confirmation bypass](https://junglewise.ai/threats/cve-2026-116794-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh SSH library zero maximum packet size denial of service](https://junglewise.ai/threats/cve-2026-116774-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh memory exhaustion via unbounded EXT_INFO packets](https://junglewise.ai/threats/cve-2026-116773-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages](https://junglewise.ai/threats/cve-2026-116696-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)