CVE-2026-48110

Name of the Vulnerable Software and Affected Versions russh versions 0.34.0 through 0.60.2

Description Several client and server message handlers decode attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer can send oversized, high-fanout, or malformed length-prefixed fields, forcing the library to allocate or split data before the input is rejected. This can lead to resource exhaustion and service-availability impact.

Technical details include affected patterns in KEX negotiation, client and server encrypted-message parsing, and shared SSH parsing helpers. Specific vulnerable fields include KEXINIT name-lists, client USERAUTH FAILURE method lists, client USERAUTH BANNER text fields, client USERAUTH PK OK fields, client EXT INFO extension fields, server SERVICE REQUEST names, server USERAUTH REQUEST header fields, server authentication fields (password, publickey, keyboard-interactive), and various channel/global request fields.

Recommendations Update to version 0.61.0. As a temporary mitigation, restrict access to the affected SSH client and server message handlers to minimize the risk of resource exhaustion.