CVE-2026-111061Medium· 4.3▾ TwilightPoC availablerussh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Exploit / PoC code exists
0.3%
0.3% → 0.3%
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.
russh < 0.64.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
russh <= 0.64.0Patched in:
russh 0.64.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102821Medium· 6.5Russh is a Rust SSH client and server library
CVE-2026-116773Medium· 4.3russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
CVE-2026-116696Low· 3.3russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
CVE-2026-116775Low· 2.3pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
CVE-2026-102825Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-102820Medium· 6.2pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance