Improper Input Validation in Russh SSH Client & Server Library by Eugeny

CVE-2026-48110

What is CVE-2026-48110?

The Russh SSH client and server library contains a vulnerability that allows remote SSH peers to exploit improper input validation. Specifically, versions 0.34.0 to before 0.61.0 are affected by message handlers that decode attacker-controlled SSH strings, name-lists, and byte fields without appropriately validating their lengths. This flaw enables attackers to send oversized or malformed data that the library may process incorrectly, potentially leading to unstable memory allocation behaviors. Users are advised to upgrade to version 0.61.0 or later, where this vulnerability is addressed.

References