CVE-2026-48110
Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.
| CWE | CWE-20 |
| Vendor | eugeny |
| Product | russh |
| Published | Jun 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for eugeny russh
Be the first to know when new high vulnerabilities affecting eugeny russh are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Eugeny / russh
>= 0.34.0, < 0.61.0