CVE-2026-116696

The record

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.

Affected packages

Related vulnerabilities

• CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption… CWE-770
• CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows… CWE-770
• CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening… CWE-770
• CVE-2026-116128 Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded… CWE-770
• CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for… CWE-770
• CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. CWE-770
• CVE-2026-90991 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-770
• CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps… CWE-770