CVE-2026-116696

The russh Rust SSH library (prior to version 0.65.0 ) contains a vulnerability in the russh::keys::agent::server::serve function. The component fails to limit the number of SSH_AGENT_CONSTRAIN_CONFIRM records added to a key's retained constraint vector, leading to unbound memory growth (CWE-770)....