Memory Growth Vulnerability in russh Rust SSH Client and Server Library

CVE-2026-116696

What is CVE-2026-116696?

The russh library, used for SSH client and server operations in Rust, contains a vulnerability wherein the server implementation improperly manages SSH_AGENT_CONSTRAIN_CONFIRM records. This oversight allows for the indefinite retention of constrained keys due to the lack of lifetime constraints, resulting in uncontrolled memory growth as repeated connections can continuously add these keys. As a result, the potential for memory exhaustion exists throughout the process's lifecycle, impacting overall system stability. This issue is addressed in version 0.65.0.

References