CVE-2026-46673: Russh Buffer Overflow Vulnerability

CVE-2026-46673 Overview

CVE-2026-46673 affects Russh, a Rust Secure Shell (SSH) client and server library maintained by Eugeny. Versions prior to 0.60.3 ship a CryptoVec implementation that performs unchecked capacity growth, unchecked length arithmetic, and unsafe allocation and locking. Local SSH agent peers can feed attacker-controlled frame lengths into buffer growth routines before validation occurs. In releases earlier than 0.58.0, the same code path is reachable from remote SSH traffic through transport and compression buffers. The maintainers patched the issue in version 0.60.3.

Critical Impact
Attackers can trigger excessive memory allocation in CryptoVec, leading to process termination and denial of service against Russh-based SSH clients, servers, and agents.

Affected Products

Russh library versions prior to 0.60.3 (local SSH agent attack surface)
Russh library versions prior to 0.58.0 (remote SSH transport and compression attack surface)
Applications and services that embed Russh as an SSH client or server

Discovery Timeline

2026-06-10 - CVE-2026-46673 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46673

Vulnerability Analysis

The vulnerability resides in CryptoVec, a buffer abstraction Russh uses to hold sensitive bytes such as decrypted SSH packets and key material. The type allows callers to grow capacity based on length fields parsed from peer-supplied frames. Russh did not validate these length values against a safe upper bound before requesting allocation. An attacker who controls frame length fields can therefore drive the process toward memory exhaustion. The Common Weakness Enumeration entry [CWE-770] classifies this as allocation of resources without limits or throttling.

Root Cause

The root cause is missing bounds enforcement around CryptoVec growth. Capacity arithmetic relies on attacker-influenced inputs without checks for overflow, sane maximums, or backpressure. The allocation and locking paths use unsafe blocks that assume well-formed sizes. When a malicious peer supplies oversized frame lengths, the library attempts to allocate buffers far larger than any legitimate SSH message.

Attack Vector

In releases prior to 0.58.0, a remote attacker who can reach a Russh server or who can serve traffic to a Russh client can deliver malformed transport or compression frames. The frame length drives CryptoVec growth before the message is authenticated. In releases between 0.58.0 and 0.60.3, the remote path is closed, but a local SSH agent peer can still reach CryptoVec through the agent protocol and trigger the same allocation behavior. Exploitation requires no authentication on the remote path and no privileges on the local agent path. The result is a denial of service through memory exhaustion or process abort.

The Russh maintainers describe the issue and the fix in the GitHub Security Advisory GHSA-g9f8-wqj9-fjw5.

Detection Methods for CVE-2026-46673

Indicators of Compromise

Sudden spikes in resident set size for processes linking Russh, followed by out-of-memory kills or SIGABRT.
SSH server or agent processes terminating shortly after receiving a single inbound connection.
Kernel oom-killer entries in dmesg or journalctl referencing Russh-based binaries.

Detection Strategies

Inventory binaries that statically link or vendor russh and compare versions against 0.60.3.
Inspect Cargo.lock files in build pipelines for russh entries below the fixed release.
Monitor SSH listener processes for abnormal allocation patterns using process accounting or eBPF allocation tracing.

Monitoring Recommendations

Alert on repeated crashes of SSH services or SSH agents within short time windows.
Track inbound SSH connection patterns that correlate with memory pressure events on hosts running Russh.
Forward SSH service logs and host telemetry into a central analytics platform so that crash loops and memory anomalies can be correlated across fleets.

How to Mitigate CVE-2026-46673

Immediate Actions Required

Upgrade all dependencies on russh to version 0.60.3 or later and rebuild affected binaries.
Restart any long-running services that embed Russh so the patched library is loaded into memory.
Restrict network exposure of Russh-based SSH servers to trusted ranges until the upgrade is deployed.

Patch Information

The maintainers fixed CVE-2026-46673 in russh version 0.60.3 by adding bounds checks around CryptoVec capacity growth and length arithmetic. Consumers should pin russh = ">=0.60.3" in their Cargo.toml and run cargo update -p russh. Refer to the GitHub Security Advisory for the full patch description.

Workarounds

Place Russh-based SSH endpoints behind a rate-limiting proxy that drops oversized or malformed SSH frames.
Disable forwarding of untrusted SSH agent sockets into processes that link vulnerable russh versions.
Apply operating system memory limits, such as systemdMemoryMax or cgroup constraints, to contain runaway allocations until patches are applied.

bash

# Configuration example: enforce a memory ceiling on a Russh-based service
sudo systemctl edit russh-service.service
# Add the following lines, then reload and restart:
# [Service]
# MemoryMax=512M
# MemoryHigh=384M
sudo systemctl daemon-reload
sudo systemctl restart russh-service.service