CVE-2026-116775Low· 2.3▾ Sunlitpageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-co…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.
russh >= 0.2.0, < 0.2.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116773Medium· 4.3russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
CVE-2026-116696Low· 3.3russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
CVE-2026-116774Medium· 4.3russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
CVE-2026-111061Medium· 4.3russh agent server converts constraint records into unbounded never-rolled-back tasks
CVE-2026-102821Medium· 6.5Russh is a Rust SSH client and server library
CVE-2026-102825Low· 3.7Russh is a Rust SSH client and server library