ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-116775

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · pageant: unbounded frame buffering

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116775. EPSS is 0.29%. Act only if a listed version of pageant: unbounded frame buffering is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (pageant: unbounded frame buffering).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.29%
Remediation
Version ranges on file
Affected products
cargo pageant · crates.io pageant · rust pageant

## Summary reads a 4-byte big-endian length prefix from its input stream and buffers until bytes are available, without ever validating . The underlying WM_COPYDATA transport physically cannot carry frames larger than 8 KiB ( , the fixed-size shared memory mapping), so an oversized frame is destined to fail — but only after the re-framing task has already buffered the full claimed size. A peer controlling the stream bytes can claim a frame of up to ~4 GiB and either stream that much data (forcing a corresponding allocation) or simply stop mid-frame and keep the partial buffer resident indefinitely. ## Vulnerable code , (the spawned re-framing task), current main: is consumed verbatim from the stream, so grows towards . Even a "complete" oversized frame cannot succeed: writes into the -sized (8192 bytes) shared mapping and fails with for anything larger — the unbounded buffering is therefore pure attacker-controlled memory growth. History: introduced in commit ("fix Tabby#10301 Still cannot login with pageant", PR #565, 2025-09-25) together with the length-prefixed framing itself; present in every 0.2.x release (0.1.0 predates the length-prefixed loop and is not affected by this issue). ## Attack scenario (SSH agent forwarding) The crate is documented as a raw transport ("This crate only implements the transport, not the actual SSH agent protocol"). The standard way to service a remote server's forwarded agent channel on Windows is to bridge the SSH channel to the local agent, e.g.: In this (intended) bridging use, the bytes written into are the SSH server's channel payload, so the 4-byte length prefix is controlled by a malicious or compromised SSH server. The server only needs to send the four bytes , then stream data (or stall). russh's typed bounds the response frames it reads with (256 KiB) and builds its own request frames, but the raw stream path — the documented transport usage — has no equivalent bound. Impact: remote memory-exhaustion DoS of the client proc

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cargo pageantversion unspecified
  • crates.io pageant0.2.0 → 0.2.5
  • rust pageant>= 0.2.0, <= 0.2.4

How to fix CVE-2026-116775

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116775. EPSS is 0.29%. Act only if a listed version of pageant: unbounded frame buffering is installed.

Which versions are affected?

Compare what you have installed with 0.2.0 → 0.2.5, >= 0.2.0, <= 0.2.4. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.29%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ## Summary reads a 4-byte big-endian length prefix from its input stream and buffers until bytes are available, without ever validating . The underlying WM_COPYDATA transport physically cannot carry frames larger than 8 KiB ( , the fixed-size shared memory mapping), so an oversized frame is destined to fail — but only after the re-framing task has already buffered the full claimed size. A peer con

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    pageant fixed in 0.2.5

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    pageant fixed in 0.2.5

  4. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ## Summary reads a 4-byte big-endian length prefix from its input stream and buffers until bytes are available, without ever validating . The underlying WM_COPYDATA transport physically cannot carry frames larger than 8 KiB ( , the fixed-size shared memory mapping), so an oversized frame is destined to fail — but only after the re-framing task has already buffered the full claimed size. A peer con

Sources

  • CVE.orgVulnerability recordCVE-2026-116775

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-662x-8wvj-2276

    pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116775

    pageant::PageantStream reads a 4-byte big-endian length prefix from its input stream and buffers until len + 4 bytes are available, without ever validating len. The underlying WM_COPYDATA transport physically cannot carry frames larger than 8 KiB (_AGENT_MAX_MSGLEN, the fixed-size shared memory mapping), so an oversized frame is destined to fail — but only after the re-framing task has already buf

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-662x-8wvj-2276

    pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

    osv.dev

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • GitHub Advisory DatabaseNov 3, 2026
  • OpenSSF OSV / OSV ScannerNov 2, 2026
  • CVE.orgOct 31, 2026