Vulnerability · CVE-2026-116773
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
Published Oct 30, 2026 · catalog updated Oct 30, 2026 · russh's SSH client is
Last checked Nov 3, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116773. EPSS is 0.26%. Act only if a listed version of russh's SSH client is is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (russh's SSH client is).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium4.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.26%
- Remediation
- Version ranges on file
- Affected products
- cargo russh · crates.io russh · rust russh
### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment.** Concretely, the evidence comes from executing the real russh v0.64.1 client packet parser ( handling ) in a live client session with attacker-supplied packet bodies in the pre-authentication state; the captured output below is from that real execution. russh's client stores every extension name it parses out of an packet into a per-session vector and never clears, caps, or deduplicates it ( , field declared at ). The packet is accepted without limit in the pre-authentication states, so a server - which is exactly the attacker position for a client library, and remains one even after the client has verified its host key - can send an unbounded sequence of these packets and grow the client's memory for as long as the session lives: 400 packets of about 26 KB each, carrying 3000 extension names apiece, retained 49.1 MiB (about 4.8 times the wire bytes) with the vector reaching 1,200,000 entries, while an equal volume of banner packets retained nothing. Two details make this reachable in practice: russh accepts in its pre-auth states with no budget of any kind (its automatic rekey read-limit only engages after authentication), and russh encodes as its own private message number 7 rather than the 8308 value 82, so the check that might interoperate with a well-behaved peer is inoperative - the malicious server simply speaks number 7. The same growth pattern has been accepted by the project before for other pre-auth allocation sinks; this one is a cross-packet accumulator rather than a single-packet allocation, and none of the published advisories covers it. ### Details The handler appends every parsed extension name to the session state with no bound: The state machine routes to this handler in both the and states ( , ), i.e. before the user has a
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- cargo russhversion unspecified
- crates.io russh0 → 0.65
- rust russh< 0.65
How to fix CVE-2026-116773
Upgrade
CVE-2026-116773 lists a fix boundary at 0.65. Compare the installed build with that boundary before you change production.
Version check
Affected < 0.65
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116773. EPSS is 0.26%. Act only if a listed version of russh's SSH client is is installed.
Which versions are affected?
Compare what you have installed with 0 → 0.65, < 0.65. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.26%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 30, 2026 · GitHub Advisory Database
Detected
### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment.** Concretely, the evidence comes from executing the real russh v0.64.1 client packet parser ( handling ) in a live client session with attacker-supplied packet bodies in the
Oct 30, 2026 · GitHub Advisory Database
Fix available
russh fixed in 0.65
Oct 30, 2026 · GitHub Advisory Database
Fix available
russh fixed in 0.65
Oct 30, 2026 · GitHub Advisory Database
Updated
### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment.** Concretely, the evidence comes from executing the real russh v0.64.1 client packet parser ( handling ) in a live client session with attacker-supplied packet bodies in the
Sources
- CVE.orgVulnerability recordCVE-2026-116773
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-4p9f-7p9m-5vfg
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116773
All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. Concretely, the evidence comes from executing the real russh v0.64.1 client packet parser (Session::process_packet handling handle_ext_info) in a live client session with attacker-supplie
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-4p9f-7p9m-5vfg
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
osv.dev
References
Freshness
Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitLab Advisory DatabaseNov 3, 2026
- GitHub Advisory DatabaseNov 3, 2026
- OpenSSF OSV / OSV ScannerNov 2, 2026
- CVE.orgOct 31, 2026