CVE-2026-116696: russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Vulnerability summary

CVE-2026-116696 is a low (CVSS 3.3) vulnerability in eugeny russh. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.2% of scored vulnerabilities.

Timeline

1. 27-10-2026
   PublishedVulnerability first disclosed.
2. 02-11-2026
   Last modifiedVulnerability information updated.

Description

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.