6 matches found
CVE-2026-111061
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...
russh: Unbounded memory allocation in agent protocol server via crafted constraint records
Summary russhkeys::agent::server::addkey russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSHAGENTCONSTRAINLIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no per-request...
GHSA-4WC5-F2RC-Q74M russh: Unbounded memory allocation in agent protocol server via crafted constraint records
Summary russhkeys::agent::server::addkey russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSHAGENTCONSTRAINLIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no per-request...
CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...
CVE-2026-111061
The russh Rust SSH client and server library contains a vulnerability in its SSH agent protocol implementation prior to version 0.64.1 . The agent server improperly handles SSH_AGENT_CONSTRAIN_LIFETIME records by spawning a separate long-lived task for every record in a constrained add-key reques...
EUVD-2026-104457
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...