EUVD-2026-111387

russh's SSH agent server is susceptible to unbound allocations via repeated SSHAGENTCONSTRAINCONFIRM messages...

CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...

CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...

CVE-2026-116794

The russh Rust SSH library (versions 0.50.0-beta.12 through 0.65.0 ) contains a vulnerability in its SSH agent protocol implementation. Specifically, the Connection::try_sign path in russh/src/keys/agent/server.rs recognizes the SSH_AGENT_CONSTRAIN_CONFIRM flag but returns a hard-coded success re...

CVE-2026-116794 russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...

CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the...

Linux Distros Unpatched Vulnerability : CVE-2026-116696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in...

CVE-2026-116794: Eugeny russh: russh is a Rust SSH client and server library that includes an SSH agent protocol implementation

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...

Linux Distros Unpatched Vulnerability : CVE-2026-111061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived...

Linux Distros Unpatched Vulnerability : CVE-2026-116774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a...

CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the...

DEBIAN-CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the...

CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

UBUNTU-CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the...

UBUNTU-CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

UBUNTU-CVE-2026-116774

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

CVE-2026-116774

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the...

CVE-2026-116774 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

CVE-2026-116774 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...