UBUNTU-CVE-2026-116773: Medium severity ubuntu/rust-russh vulnerability
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the standards-compliant EXTINFO message number 82 does not reach the affected handler. The handleextinfo function appends every parsed extension name to receivedextensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.65.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using affected versions of the russh library are exposed when they connect to a malicious SSH server. The server can send repeated private message-number 7 packets before authentication to grow client memory usage for the lifetime of the session.
Does exploitation require authentication or user interaction?
The attack occurs before authentication and does not require attacker privileges. User interaction is required because a client must connect to the malicious SSH server.
What can be done if upgrading is not immediately possible?
Avoid connecting affected clients to untrusted SSH servers, since the malicious server controls the packets that trigger unbounded extension-name retention. Ending the affected SSH session releases the session-lifetime memory growth.
How can I determine whether my deployment is affected?
Check whether the application uses rust-russh and whether its russh version is earlier than 0.65.0. Affected clients may show progressively increasing memory consumption during a connection to a server sending repeated private message-number 7 packets before authentication.