CVE-2026-48110: Russh Library Buffer Overflow Vulnerability

CVE-2026-48110 Overview

CVE-2026-48110 affects russh, a Rust SSH client and server library used to build SSH-capable applications. Versions from 0.34.0 up to but not including 0.61.0 mishandle attacker-controlled SSH message fields during decoding. Several client and server message handlers decode SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds checks. A remote SSH peer can send oversized, high-fanout, or malformed length-prefixed fields that force russh to allocate or split data before the input is rejected. The maintainers patched the issue in version 0.61.0.

Critical Impact
A remote, unauthenticated SSH peer can trigger excessive memory allocation in russh-based clients and servers, causing denial of service.

Affected Products

russh versions 0.34.0 through 0.60.x
Applications embedding russh as an SSH client library
Applications embedding russh as an SSH server library

Discovery Timeline

2026-06-10 - CVE-2026-48110 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-48110

Vulnerability Analysis

The weakness sits in russh's SSH wire-format decoding path. SSH messages use length-prefixed strings, name-lists, and byte sequences. Russh handlers read the declared length from the peer and immediately allocate an owned buffer or split a slice to hold the decoded value. Only after that allocation does the code apply field-specific limits such as maximum string length, allowed name-list entries, or expected byte counts.

This ordering lets a remote peer drive memory consumption with attacker-controlled length prefixes. The library may allocate gigabyte-scale buffers or attempt high-fanout allocations during name-list parsing before rejecting the message. The flaw maps to [CWE-20] Improper Input Validation. Because russh ships as both a client and server library, both roles are exposed across the SSH handshake and post-authentication channel layers.

Root Cause

The handlers decode untrusted length-prefixed fields into owned allocations before validating bounds. Validation runs after allocation rather than against the raw declared length. Malformed inputs that should have been rejected on sight instead consume memory and CPU during decoding.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. A remote SSH peer crafts SSH packets with oversized string lengths, high-cardinality name-lists, or malformed byte fields. The peer sends these during the SSH banner, key exchange, or channel-handling phases. The russh process then allocates or attempts to allocate the declared sizes before rejecting the input, exhausting memory and producing a denial-of-service condition.

No verified public exploit code is available. See the GitHub Security Advisory for the maintainer's technical write-up.

Detection Methods for CVE-2026-48110

Indicators of Compromise

Russh client or server processes terminating with out-of-memory errors or allocator panics shortly after accepting an SSH connection.
Sudden resident set size (RSS) spikes on hosts running russh-backed services during the SSH handshake phase.
SSH sessions that disconnect during key exchange or channel setup with abnormally large declared field lengths in packet captures.

Detection Strategies

Inspect dependency manifests (Cargo.toml, Cargo.lock) across the build fleet for russh entries with versions earlier than 0.61.0.
Capture SSH traffic to russh listeners and flag packets where length-prefixed fields exceed protocol-reasonable sizes (for example, SSH strings beyond 256 KiB).
Correlate SSH connection events with process memory pressure or restarts using endpoint telemetry.

Monitoring Recommendations

Alert on repeated crashes or restarts of services that embed russh.
Monitor inbound SSH connection rates from single source addresses against russh-backed servers.
Track Cargo Software Bill of Materials (SBOM) output to flag the appearance of vulnerable russh versions in new builds.

How to Mitigate CVE-2026-48110

Immediate Actions Required

Upgrade the russh dependency to version 0.61.0 or later and rebuild any binaries that link against it.
Audit production hosts for long-running services compiled against vulnerable russh versions and schedule redeployment.
Restrict network exposure of russh-based SSH servers to trusted source ranges until patched builds are deployed.

Patch Information

The maintainers fixed the issue in russh 0.61.0 by validating length-prefixed field bounds before allocating owned buffers. Update the russh entry in Cargo.toml, run cargo update -p russh, and recompile. Full remediation details are available in the GitHub Security Advisory GHSA-4r3c-5hpg-58qr.

Workarounds

Place russh-based SSH endpoints behind a network filter that drops connections from untrusted sources.
Apply per-process memory limits (for example, systemd MemoryMax= or container memory caps) to bound the blast radius of allocation abuse.
Rate-limit inbound SSH connections to reduce the chance of repeated allocation attempts from a single peer.

bash

# Update russh to the patched release
cargo update -p russh --precise 0.61.0
cargo build --release