Memory Exhaustion Vulnerability in Russh SSH Client and Server Library
CVE-2026-111061

4.3MEDIUM

Key Information:

Vendor: Eugeny
Status: Russh
Vendor: CVE Published:; 19 October 2026

What is CVE-2026-111061?

The Russh library, an SSH client and server implementation in Rust, has a vulnerability that allows an attacker to exploit the SSH agent protocol. In versions prior to 0.64.1, the agent server fails to properly manage tasks related to constrained add-key requests. By sending multiple lifetime records, an attacker can create numerous long-lived tasks, ultimately leading to memory exhaustion and denial of service for the SSH agent. This serious can leave the agent process unresponsive, affecting its availability. The issue is addressed in version 0.64.1.