EUVD-2026-111387

russh's SSH agent server is susceptible to unbound allocations via repeated SSHAGENTCONSTRAINCONFIRM messages...

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. The SSH agent server that ships with russh russh::keys::agent::server::serve...

GHSA-9WFM-JCJ8-JFV9 russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. The SSH agent server that ships with russh russh::keys::agent::server::serve...

DEBIAN-CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...

CVE-2026-116794 russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...

CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

Linux Distros Unpatched Vulnerability : CVE-2026-116696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in...

PT-2026-128344

Name of the Vulnerable Software and Affected Versions russh versions 0.50.0-beta.12 through 0.64.0 Description The agent server's Connection::try sign path in russh/src/keys/agent/server.rs recognizes SSH AGENT CONSTRAIN CONFIRM but returns a hard-coded successful result instead of calling...

Eugeny Russh authorization issue vulnerability

Versions prior to 0.65 of Eugeny Russh contain an authorization issue vulnerability. This vulnerability arises because in russh/src/keys/agent/server.rs, the Connection::trysign path within the agent server returns a hardcoded success result after identifying SSHAGENTCONSTRAINCONFIRM, without...

CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

CVE-2026-116696 russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

CVE-2026-116696: Allocation of Resources Without Limits or Throttling

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

PT-2026-127229

Name of the Vulnerable Software and Affected Versions russh versions prior to 0.65.0 Description The russh::keys::agent::server::serve function in russh/src/keys/agent/server.rs accepts repeated SSH AGENT CONSTRAIN CONFIRM records when adding a key. It appends every Constraint::Confirm record to...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-111061

The russh Rust SSH client and server library contains a vulnerability in its SSH agent protocol implementation prior to version 0.64.1 . The agent server improperly handles SSH_AGENT_CONSTRAIN_LIFETIME records by spawning a separate long-lived task for every record in a constrained add-key reques...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

PT-2026-117497

Name of the Vulnerable Software and Affected Versions russh versions prior to 0.64.1 Description The agent server in the library contains a flaw where it spawns a separate long-lived task for every SSH AGENT CONSTRAIN LIFETIME record received in a constrained add-key request. The add key function...

PT-2026-117997

Summary russh keys::agent::server::add key russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSH AGENT CONSTRAIN LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no...

CVE-2026-18875

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert CWE-74 in the FTM AI agent server api.vectordb.runbooks.js:51. An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer...