CVE-2026-111061

Name of the Vulnerable Software and Affected Versions russh versions prior to 0.64.1

Description The agent server in the library contains a flaw where it spawns a separate long-lived task for every SSH AGENT CONSTRAIN LIFETIME record received in a constrained add-key request. The add key() function in russh keys::agent::server::add key clones the key blob into each task and does not roll back these tasks if subsequent constraint parsing fails. An attacker capable of communicating via the agent protocol locally or through agent forwarding can send repeated lifetime records to exhaust memory and task capacity. This can lead to the agent process being starved or terminated, resulting in a denial of service. Technical measurements indicate significant memory amplification, where a small amount of protocol traffic can generate millions of live tasks and gigabytes of resident set size (RSS) memory.

Recommendations Update to version 0.64.1.