CVE-2026-111061: falha de média gravidade em Eugeny russh
russh agent server converts constraint records into unbounded never-rolled-back tasks
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
Eugeny · russhCVEs relacionadas — Eugeny russh
No mesmo produto, das mais perigosas para as menos.
CVE-2024-43410HIGHRussh has an OOM Denial of Service due to allocation of untrusted amountEPSS 0.9%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.6%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.5%CVE-2026-42189HIGHRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive authEPSS 0.5%CVE-2026-73489MEDIUMRussh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsEPSS 0.5%CVE-2025-54804MEDIUMRussh is missing an overflow check during channel windows adjustEPSS 0.4%