CVE-2026-102821: Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Published Sep 29, 2026
·
Updated

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.

Affected Software

1 affected component
crates.io/russh<0.63.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade russh to a version that resolves this vulnerability.

    Fixed in 0.63.2

Event History

Sep 29, 2026
CVE Published
via MITRE·06:21 PM
Data Sourced
via MITRE·06:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An authenticated remote SSH peer can exploit it. The attacker needs a valid authenticated connection to a server using the affected Russh library.

2

What conditions are required to trigger the memory exhaustion?

The peer sends SSH_MSG_KEXINIT but does not send the required SSH_MSG_KEX_ECDH_INIT, leaving rekeying in progress. It then floods the connection with SSH_MSG_CHANNEL_OPEN messages, causing ChannelOpenReply messages to accumulate on an unbounded channel.

3

What is the impact on an affected server?

A single malicious connection can cause unbounded memory growth until the server process is terminated. The reported impact is availability loss; no confidentiality or integrity impact is specified.

4

Which versions are affected and how should this be remediated?

Russh versions prior to 0.63.2 are affected. Upgrade to version 0.63.2, which contains the fix.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203