CVE-2026-116696
Deferred Deferred - Pending Action

Memory Exhaustion in Russh SSH Agent

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116696
EUVD
EUVD-2026-111387

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eugeny russh < 0.65.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the russh library, an SSH client and server library in Rust. It involves the SSH agent protocol implementation where repeated SSH_AGENT_CONSTRAIN_CONFIRM records can be accepted while adding a key. The server appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. This allows an attacker who can connect to the agent socket to repeatedly add constrained keys, causing renewable memory growth that persists for the process lifetime.

Impact Analysis

If you use the russh library in your application, an attacker who can connect to the SSH agent socket may exploit this vulnerability to cause a denial of service by consuming excessive memory. This could lead to system slowdowns or crashes, especially in long-running processes.

Mitigation Strategies

Upgrade russh to version 0.65.0 or later to address the memory growth issue in the SSH agent implementation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart