ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-111061

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

Published Oct 19, 2026 · catalog updated Oct 20, 2026 · russh: Unbounded memory allocation

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-111061. A missing EPSS score is not a low risk. Compare russh: Unbounded memory allocation with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (russh: Unbounded memory allocation).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium4.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Advisory link
Affected products
Debian:14 rust-russh · crates.io russh

### Summary ( ) spawns a dedicated tokio task for every 5-byte record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and heap at roughly 141x amplification: in our measurement 10.2 MiB of protocol traffic produced ~2,096,120 live tasks and +1,447,856 KiB RSS, while the same traffic sent as unconstrained add-key requests cost +268 KiB. An attacker reaching the agent socket (a local process, or a remote SSH server the user connects to with agent forwarding, since russh clients accept the channel by default at ) can exhaust the agent process's memory and task capacity with a renewable, cheap request stream. Verified on russh HEAD efa9a03 (v0.63.3-10, 2026-10-01). ### Details Each lifetime record clones the key blob into a new task regardless of how many records the same request already spawned, and a failure later in the request leaves earlier tasks alive. Data flow: agent connection -> SSH_AGENTC_ADD_IDENTITY_CONSTRAINED -> constraint decode loop -> unbounded per 5 bytes. The control measurement (identical wire volume as unconstrained adds) isolates the constraint path as the amplifier. ### Proof of concept Prerequisites: Linux host with cargo and git. The archive's deploy script provisions russh at the pinned revision and the PoC crate (rewriting the path dependency); the PoC runs a real russh agent server on loopback and speaks the agent protocol to it. The broker acks every request (code 6 = SUCCESS) while RSS grows to +1.45 GB from ~10 MiB of input. The harness's control mode (same wire volume, unconstrained adds) measured +268 KiB. The automated archive run reproduces exactly this trace. #### Manual reproduction, step by step (no archive required) 1. Provision russh at the pinned revisi

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:14 rust-russh0 → 0.64.1-1
  • crates.io russh0 → 0.64.1

How to fix CVE-2026-111061

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-111061. A missing EPSS score is not a low risk. Compare russh: Unbounded memory allocation with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 0.64.1-1, 0 → 0.64.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-770: Allocation of Resources Without Limits or Throttling. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 19, 2026 · GitHub Advisory Database

    Detected

    ### Summary ( ) spawns a dedicated tokio task for every 5-byte record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks a

  2. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    russh fixed in 0.64.1

  3. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    russh fixed in 0.64.1

  4. Oct 19, 2026 · GitHub Advisory Database

    Updated

    ### Summary ( ) spawns a dedicated tokio task for every 5-byte record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks a

  5. Oct 20, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    rust-russh fixed in 0.64.1-1

  6. Oct 20, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    rust-russh fixed in 0.64.1-1

  7. Oct 20, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attac

Sources

References

Freshness

Last verified in this catalog Oct 20, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.