Heap Overflow in Russh SSH Library

Executive Summary

The vulnerability exists in the Russh Rust SSH client and server library versions from 0.34.0 up to but not including 0.61.0. Several message handlers in the library improperly decode attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying specific bounds checks. This means a remote SSH peer can send oversized, high-fanout, or malformed length-prefixed fields that cause the library to allocate or attempt to allocate excessive memory or improperly split data before rejecting the input. This flaw could lead to resource exhaustion or other issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to cause the Russh library to allocate excessive memory or process malformed data, potentially leading to denial of service (DoS) conditions. Since the CVSS score rates the impact on availability as high (A:H) and no impact on confidentiality or integrity, the main risk is disruption of service or resource exhaustion on systems using vulnerable versions of the Russh library.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the russh Rust SSH client and server library has been patched in version 0.61.0.

To mitigate this vulnerability, you should immediately upgrade any affected russh library versions from 0.34.0 up to but not including 0.61.0 to version 0.61.0 or later.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in russh (CVE-2026-48110) primarily impacts availability due to a denial-of-service (DoS) risk caused by excessive memory allocation triggered by malformed SSH messages.

There is no demonstrated impact on confidentiality or integrity, which are critical factors for compliance with standards like GDPR or HIPAA.

Therefore, while the vulnerability could affect system availability, it does not directly compromise personal data confidentiality or integrity required by these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves specially crafted SSH packets with oversized, malformed, or high-fanout length-prefixed fields such as large KEXINIT messages or SERVICE_REQUEST messages with excessive length prefixes. Detection can focus on monitoring SSH traffic for unusually large or malformed SSH message fields that could trigger excessive memory allocation.

To detect potential exploitation attempts on your system or network, you can capture and analyze SSH traffic for abnormal packet sizes or malformed fields using network analysis tools.

• Use tcpdump or tshark to capture SSH traffic and filter for large packets, for example: tcpdump -i <interface> port 22 and greater than 1000
• Use tshark to extract and analyze SSH packet details, looking for unusually large KEXINIT or SERVICE_REQUEST messages.
• Monitor SSH server logs for unusual connection attempts or errors related to parsing SSH messages.

Since the vulnerability is in the russh library versions 0.34.0 to before 0.61.0, ensure your software is updated to version 0.61.0 or later to prevent exploitation.

Useful 0 Not Useful 0