CVE-2026-111061
Deferred Deferred - Pending Action

Memory Exhaustion in Russh SSH Agent

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111061
EUVD
EUVD-2026-104457

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eugeny russh < 0.64.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the russh SSH library's agent server. It allows an attacker to send crafted messages with repeated SSH_AGENT_CONSTRAIN_LIFETIME records, causing the server to spawn unlimited tasks that clone key data and consume excessive memory. The server fails to limit tasks or roll back on errors, leading to rapid resource exhaustion.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage or task spawning in the russh agent process. Check for millions of Tokio tasks or memory consumption over 1.4 GB. Use system monitoring tools like top, htop, or ps to inspect process resources. If the agent process becomes unresponsive or crashes, it may indicate exploitation.

Impact Analysis

An attacker with local or forwarded SSH agent access can crash or slow down the agent process by consuming all available memory and tasks. This denies SSH agent services, potentially preventing users from authenticating via SSH keys until the agent restarts.

Compliance Impact

This vulnerability primarily impacts availability by allowing denial of service through resource exhaustion. It does not directly affect confidentiality or integrity of data. Compliance with standards like GDPR or HIPAA typically requires ensuring availability of systems processing personal or health data. While this vulnerability could disrupt SSH agent services, it does not inherently violate these standards unless it leads to unauthorized data access or prolonged downtime affecting regulated operations.

Mitigation Strategies

Upgrade the russh library to version 0.64.1 or later, which includes the security fix. If upgrading is not immediately possible, restrict access to the SSH agent protocol locally and via agent forwarding to trusted users only. Disable agent forwarding in SSH configurations if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart