CVE-2026-116775— pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Quick assessment

Affected

Eugeny russh

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pageant 提供了一个名为的类型，该类型实现了和特性，可用于与正在运行的 Pageant 实例进行通信。在 0.2.0 至 0.2.5 版本期间，中的函数信任由对端控制的 4 字节长度前缀，并在未检查固定传输容量的情况下，一直缓冲直到可用数据量达到字节。若某个应用程序将 SSH 转发的代理通道桥接到原始流，则可能允许恶意服务器强制进行大内存分配，或保留部分填充的数据帧，从而导致客户端内存耗尽。该问题已在 0.2.5 版本中修复。

CVSS 2.3 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Source: CVE Program / CVE List V5

Vulnerability Description

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Eugeny	russh	>= 0.2.0, < 0.2.5	-

II. Public POCs for CVE-2026-116775

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116775

请登录查看更多情报信息。

Other References for CVE-2026-116775 (3)

https://github.com/Eugeny/russh/releases/tag/v0.65.0 x_refsource_MISC
https://github.com/Eugeny/russh/security/advisories/GHSA-662x-8wvj-2276 x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/69e4b55513eaa8ac9d2ad4236f13171fc164e10a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116775

Same Patch Batch · Eugeny · 2026-10-27 · 4 CVEs total

CVE-2026-116774	4.3 MEDIUM	russh: peer-declared zero maximum packet size permanently stalls channel writes (silent As
CVE-2026-116773	4.3 MEDIUM	russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
CVE-2026-116696	3.3 LOW	russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONS

IV. Related Vulnerabilities

Same product: russh

Same vendor: Eugeny

Same weakness: CWE-770