Buffer Overflow Vulnerability in Russh Rust SSH Client and Server Library
CVE-2026-46673

7.5HIGH

Key Information:

Vendor

Eugeny

Status
Russh
Vendor
CVE Published:
10 June 2026

What is CVE-2026-46673?

The Russh library, a Rust SSH client and server, exhibits a vulnerability due to unchecked capacity growth and unsafe memory handling prior to version 0.60.3. Local SSH agents could exploit this flaw by sending attacker-controlled frame lengths, leading to potential buffer overflow. Earlier versions before 0.58.0 are also affected by remote SSH traffic manipulations that can reach the affected buffer. This vulnerability has been addressed in version 0.60.3.

Affected Version(s)

russh < 0.60.3

References

https://github.com/Eugeny/russh/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.