CVE-2026-116773

The russh Rust SSH client library (prior to version 0.65.0 ) is vulnerable to memory exhaustion due to unbounded allocations in the Session::process_packet path located in russh/src/client/encrypted.rs. The handle_ext_info function fails to deduplicate or bound the received_extensions vector when...