Vulnerability RUSTSEC-2026-0154
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 months ago
May 15, 2026 at 12:00 PM UTC
Unbounded 32-bit allocation
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.60.2
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.60.2
Summary
Unbounded 32-bit allocation
Details
Both the SSH agent server and client accepted peer-controlled frame lengths without enforcing a maximum frame size. This could cause large memory allocations while parsing a maliciously crafted agent frame.
A malicious peer could advertise an oversized frame length, causing the client or server to attempt a large memory allocation before validating the frame, potentially leading to memory exhaustion or process termination.
This is fixed by enforcing a maximum agent frame size of 256 KiB and rejecting oversized frames before buffer allocation.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
11 days ago
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 and 0.63.0 - 0.63.1 GHSA-35g8-35p8-c8fw
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 and 0.63.0 - 0.63.1 GHSA-35g8-35p8-c8fw
Low Risk
11 days ago
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 and 0.63.0 GHSA-p8qx-h547-fjw9
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 and 0.63.0 GHSA-p8qx-h547-fjw9
High Risk
11 days ago
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 and 0.63.0 GHSA-47hw-gvq5-r2gm
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 and 0.63.0 GHSA-47hw-gvq5-r2gm
Medium Risk
11 days ago
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 GHSA-w3jg-pjxf-73p4
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.7 GHSA-w3jg-pjxf-73p4
Low Risk
11 days ago
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.5 GHSA-g6xm-f9xp-qq35
0.34.0 and 0.36.0 - 0.36.2 and 0.37.1 and 0.38.0 and 0.39.0 - 0.40.2 and 0.42.0 and 0.43.0 and 0.44.0 - 0.45.0 and 0.46.0 and 0.48.0 - 0.49.2 and 0.50.0 - 0.50.4 and 0.51.0 - 0.51.1 and 0.52.0 - 0.52.1 and 0.53.0 - 0.62.5 GHSA-g6xm-f9xp-qq35
Impacted packages
Timeline
Published
5 months ago
May 15, 2026 at 12:00 PM UTC
Fixed (0.60.3)
4 months ago
May 15, 2026 at 09:13 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC