PT-2026-45017 · Eugeny+3 · Russh+1
CVE-2026-46702
·
Published
2026-05-29
·
Updated
2026-06-11
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
russh versions 0.34.0 through 0.61.0
Description
When SSH compression is enabled, the software accepts compressed packets that pass initial transport packet-length checks but expand to a much larger size upon decompression. This occurs because the
packet length field and MAC are computed over the compressed payload, allowing a small on-wire packet to inflate into an oversized message body. Specifically, the Decompress::decompress() function grew its output buffer by repeated doubling without enforcing a post-decompression ceiling.This leads to a remote denial-of-service and resource-exhaustion issue in the post-decompression receive path. In versions prior to 0.58.0, the decompression path used
CryptoVec, which increased the impact by potentially causing the process to abort under constrained memory. An unauthenticated remote attacker can exploit this by negotiating zlib compression and sending a crafted SSH MSG DEBUG packet that remains below the 256 KiB transport cap but exceeds the intended post-decompression bound.Recommendations
Update to version 0.61.1 or later.
As a temporary workaround, disable SSH compression or restrict the use of
zlib and zlib@openssh.com in the server configuration to prevent the negotiation of compressed packets.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Russh
Rust-Russh