Memory exhaustion vulnerability in russh SSH client and server library

CVE-2026-116773

What is CVE-2026-116773?

The russh SSH client and server library contains a vulnerability where the client can become susceptible to memory exhaustion. If an attacker controls an SSH server and sends repeated packets with the private extension number 7, the Session::process_packet function fails to handle these packets correctly. This issue allows the attacker to append an unlimited number of extension names during a session, leading to memory exhaustion and potentially crashing the client. This vulnerability persists in versions prior to 0.65.0; updating to this version resolves the issue.

References