Remote Denial-of-Service Vulnerability in Russh SSH Client and Server
CVE-2026-46702

7.5HIGH

Key Information:

Vendor

Eugeny

Status
Russh
Vendor
CVE Published:
10 June 2026

What is CVE-2026-46702?

Russh, a popular Rust SSH client and server library, has a vulnerability that allows an attacker to exploit packet compression features. If SSH compression is enabled, the client can accept compressed packets that bypass size checks, leading to oversized post-decompression packets. This flaw can trigger a denial-of-service condition by exhausting server resources. Versions before 0.61.1 are affected, with older versions potentially experiencing worse impacts due to the use of CryptoVec in the decompression path. The issue has been resolved in version 0.61.1.

Affected Version(s)

russh >= 0.34.0, < 0.61.1

References

https://github.com/Eugeny/russh/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.