CVE-2026-48110
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 10, 2026
CISA due date
—
The record
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | russh | 0.34.0 | 0.61.0 |
Related vulnerabilities
- GHSA-4r3c-5hpg-58qr Russh SSH message fields were decoded through allocation-first parsers before… Same vulnerability
- GHSA-76r6-x97p-67vr Russh: SSH identification parsing accepted non-canonical client banners and did not bound… Also affects russh
- GHSA-g9g7-5cgw-6v28 Russh: Unchecked keyboard-interactive prompt count in client auth path Also affects russh
- CVE-2026-48108 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-46702 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-46705 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-46673 Russh is a Rust SSH client & server library. Also affects russh
- CVE-2026-48107 Russh is a Rust SSH client & server library. Also affects russh