CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b
https://github.com/Eugeny/russh/releases/tag/v0.63.2
https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw
https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw

Configurations

No configuration.

History

30 Sep 2026, 20:17

Type	Values Removed	Values Added
References	~~() https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw -~~	() https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw -

29 Sep 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-29 19:17

Updated : 2026-09-30 20:17

NVD link : CVE-2026-102821

Mitre link : CVE-2026-102821

CVE.ORG link : CVE-2026-102821

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-102821", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102821", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:34:47.748081Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": "< 0.63.2"}]}]}], "published": "2026-09-29T19:17:23.993", "references": [{"url": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b", "source": "security-advisories@github.com"}, {"url": "https://github.com/Eugeny/russh/releases/tag/v0.63.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "source": "security-advisories@github.com"}, {"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2."}], "lastModified": "2026-09-30T20:17:23.793", "sourceIdentifier": "security-advisories@github.com"}