CVE-2026-116773— russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

Quick assessment

Affected

Eugeny russh

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

russh 是一个用 Rust 编写的 SSH 客户端和服务器库，其中包含了 SSH 代理协议的实现。在 0.65.0 版本之前，客户端位于 russh/src/client/encrypted.rs 中的 Session::process_packet 路径会接受在认证前重复发送的、使用 russh 私有消息类型 msg::EXT_INFO = 7 编码的数据包，而符合标准的 EXT_INFO 消息（编号 82）则无法到达受影响的处理程序。handle_ext_info 函数会将每个解析出的扩展名称追加到 rec

CVSS 4.3 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

Source: CVE Program / CVE List V5

Vulnerability Description

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INFO message number 82 does not reach the affected handler. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Eugeny	russh	< 0.65.0	-

II. Public POCs for CVE-2026-116773

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116773

请登录查看更多情报信息。

Other References for CVE-2026-116773 (3)

https://github.com/Eugeny/russh/releases/tag/v0.65.0 x_refsource_MISC
https://github.com/Eugeny/russh/security/advisories/GHSA-4p9f-7p9m-5vfg x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/b33e93beec393e6d29eee69c1b8831736724ee75 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116773

Same Patch Batch · Eugeny · 2026-10-27 · 4 CVEs total

CVE-2026-116774	4.3 MEDIUM	russh: peer-declared zero maximum packet size permanently stalls channel writes (silent As
CVE-2026-116696	3.3 LOW	russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONS
CVE-2026-116775	2.3 LOW	pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaust

IV. Related Vulnerabilities

Same product: russh

Same vendor: Eugeny

Same weakness: CWE-770