CVE-2026-116773: russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the standards-compliant EXTINFO message number 82 does not reach the affected handler. The handleextinfo function appends every parsed extension name to receivedextensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.65.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using russh as an SSH client and processing connections to untrusted or malicious SSH servers are exposed if they use a version before 0.65.0. The affected path is in the client Session::process_packet handling before authentication.
What must an attacker do to trigger the memory exhaustion?
An attacker must operate or control an SSH server that the client connects to and send repeated packets using russh's private EXT_INFO message number 7 before authentication. The standards-compliant EXT_INFO message number 82 does not reach the affected handler.
Does exploitation require authentication or user interaction?
No authentication is required because the affected packet handling occurs before authentication. A client must connect to the malicious SSH server, after which the server can progressively consume client memory by sending repeated crafted packets.
What is the remediation?
Upgrade russh to version 0.65.0, which fixes the unbounded accumulation of parsed extension names.