CVE-2026-46673High· 7.5▾ TwilightUnbounded 32-bit allocation
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
Both the SSH agent server and client accepted peer-controlled frame lengths without enforcing a maximum frame size. This could cause large memory allocations while parsing a maliciously crafted agent frame.
A malicious peer could advertise an oversized frame length, causing the client or server to attempt a large memory allocation before validating the frame, potentially leading to memory exhaustion or process termination.
This is fixed by enforcing a maximum agent frame size of 256 KiB and rejecting oversized frames before buffer allocation.
russh >= 0.0.0-0, < 0.60.3Upgrade to a patched release:
russh 0.60.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102825Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-102820Medium· 6.2pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance
CVE-2026-102821Medium· 6.5Russh is a Rust SSH client and server library
CVE-2026-102822Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-102823High· 7.5Russh is a Rust SSH client and server library
CVE-2026-102824Medium· 4.3Russh is a Rust SSH client and server library