CVE-2026-46673
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 10, 2026
CISA due date
—
The record
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | russh | 0 | 0.60.3 |
| crates.io | russh | 0.0.0-0 | 0.60.3 |
| crates.io | russh-cryptovec | 0 | 0.60.3 |
| crates.io | russh-cryptovec | 0.0.0-0 | 0.60.3 |
Related vulnerabilities
- RUSTSEC-2026-0154 Unbounded 32-bit allocation Same vulnerability
- GHSA-4r3c-5hpg-58qr Russh SSH message fields were decoded through allocation-first parsers before… Also affects russh
- GHSA-76r6-x97p-67vr Russh: SSH identification parsing accepted non-canonical client banners and did not bound… Also affects russh
- GHSA-g9g7-5cgw-6v28 Russh: Unchecked keyboard-interactive prompt count in client auth path Also affects russh
- CVE-2026-48108 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-48110 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-46702 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-46705 Russh is a Rust SSH client & server library. Also affects russh