RUSTSEC-2026-0154: Unbounded 32-bit allocation

What to do

1. See which version you have: cargo tree -i russh (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p russh. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example russh = "0.60.3") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Both the SSH agent server and client accepted peer-controlled frame lengths without enforcing a maximum frame size. This could cause large memory allocations while parsing a maliciously crafted agent frame.

A malicious peer could advertise an oversized frame length, causing the client or server to attempt a large memory allocation before validating the frame, potentially leading to memory exhaustion or process termination.

This is fixed by enforcing a maximum agent frame size of 256 KiB and rejecting oversized frames before buffer allocation.

References

• Package: crates.io/crates/russh
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0154.html
• Web: github.com/Eugeny/russh/commit/a2d48a71fe93d18cbd666c8d53d0882f5ce110c4
• Web: github.com/Eugeny/russh/commit/a2d48a71fe93d18cbd666c8d53d0882f5ce110c4

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for russh

• VulnerabilityGHSA-35g8-35p8-c8fw · 2026-09-30Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
• VulnerabilityGHSA-45x7-px36-x8w8 · 2023-12-18Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
• VulnerabilityGHSA-47hw-gvq5-r2gm · 2026-09-30russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
• VulnerabilityGHSA-4r3c-5hpg-58qr · 2026-06-11Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds
• VulnerabilityGHSA-4wc5-f2rc-q74m · 2026-10-19russh: Unbounded memory allocation in agent protocol server via crafted constraint records
• VulnerabilityGHSA-5xvq-cp9x-6p6r · 2026-07-24Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
• VulnerabilityGHSA-76r6-x97p-67vr · 2026-06-11Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
• VulnerabilityGHSA-cqjc-rmpq-xprq · 2026-07-24Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Full security history of russh