CVE-2026-48110: Russh SSH Library Memory Allocation Denial of Service

Technical summary

The vulnerability stems from improper input validation order in russh's SSH message parsing. Multiple message handlers decode SSH protocol strings, name-lists, and byte fields into owned heap allocations before applying field-specific length bounds and format checks. An attacker can exploit this by sending SSH packets with oversized length-prefixed fields, high-fanout data structures, or malformed content that triggers allocation operations that should have been prevented by earlier validation. The root cause is CWE-20 (Improper Input Validation), where length validation occurs after memory commitment rather than before.

Business impact

Applications and services using vulnerable versions of russh for SSH functionality face denial-of-service risk. An unauthenticated remote attacker can crash SSH servers or clients, or degrade performance by forcing memory exhaustion. This is particularly concerning for infrastructure automation tools, bastion hosts, monitoring agents, or any service that embeds russh for SSH protocol handling. Even though the vulnerability does not permit data theft or code execution, availability impact can disrupt critical operations.

Affected systems

Any Rust application linking russh versions 0.34.0 through 0.60.x is affected. This includes both SSH client and server implementations. The vulnerability does not require vendor affiliation; it affects all direct consumers of the russh library. Indirect users through transitive dependencies should audit their dependency trees.

Exploitability

Exploitability is high. The vulnerability requires only network access and no authentication. An attacker needs only to send a single crafted SSH message to trigger the memory allocation issue. The attack surface includes any exposed SSH port or SSH client that connects to attacker-controlled servers. No special conditions or user interaction are required.

Remediation

Upgrade russh to version 0.61.0 or later. For projects unable to upgrade immediately, consider restricting SSH connections to trusted peers via firewall or network policies to reduce exposure. Monitor for unusual memory consumption or SSH connection rejections on affected services.

Patch guidance

Update the russh dependency in your Cargo.toml to version 0.61.0 or any subsequent release. Run 'cargo update russh' to pull the patched version, then rebuild and redeploy your application. Verify the update in your dependency lock file (Cargo.lock) before committing. No code changes are required; the patch is purely a library upgrade.

Detection guidance

Monitor SSH services for repeated failed or rejected connections, particularly those with unusual packet payloads or connection patterns. Look for memory pressure events correlating with SSH session attempts. Application-level logging in russh (if enabled) may show parsing errors or allocation failures. Network-based detection is difficult without deep SSH protocol inspection; host-based monitoring of memory usage spikes during SSH activity is more practical.

Why prioritize this

This vulnerability merits prompt patching due to its HIGH CVSS score (7.5), unauthenticated remote exploitability, and impact on availability. While not enabling data theft or code execution, denial of service on SSH infrastructure can cascade into broader system unavailability. The fix is mature (version 0.61.0 released), straightforward (dependency upgrade), and carries no backward compatibility risk in most cases.

Risk score, explained

CVSS 7.5 (HIGH) reflects unauthenticated network-accessible denial of service with no privileges required (AV:N/AC:L/PR:N/UI:N) and impact limited to availability (A:H). The score appropriately penalizes the ease of triggering the flaw but does not elevate it to critical because confidentiality and integrity are not compromised. In environments where SSH availability is critical, the business impact may warrant treating this as higher priority than the numerical score suggests.

Frequently asked questions