CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT INFO = 7 before authentication, while the standards-compliant EXT INFO message number 82 does not reach the affected handler. The handle ext info function appends every parsed extension name to received extensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.