CVE-2026-111061 in russh
Summary
by MITRE • 10/19/2026
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within the russh library, a Rust-based implementation of both an SSH client and server including its associated agent protocol, represents a significant resource exhaustion flaw rooted in improper input validation and state management during key constraint processing. Specifically, this issue affects versions prior to 0.64.1 and centers on the handling of SSH_AGENT_CONSTRAIN_LIFETIME records within constrained add-key requests. When an SSH client initiates a request to add a private key with lifetime constraints, the server component is designed to spawn separate long-lived tasks for each specified constraint record. This architectural decision allows for parallel management of key lifetimes but introduces critical flaws in how these resources are allocated and managed when input validation fails mid-process.
The core technical flaw lies in the loop that processes repeated lifetime records. For every SSH_AGENT_CONSTRAIN_LIFETIME entry found in a request, the system allocates memory by cloning the key blob into a newly spawned task. However, the implementation lacks robust error handling for subsequent constraint parsing failures. If an attacker provides a malformed or excessively large number of lifetime constraints such that later entries fail to parse correctly due to invalid data structures or protocol violations, the tasks already created and populated with cloned key blobs are not rolled back or terminated. This results in orphaned resources where memory is consumed by active tasks associated with keys that were never fully accepted into the agent's operational state. The failure to clean up these partially initialized contexts creates a direct path for resource leakage.
From an operational perspective, this vulnerability enables a local denial of service attack against the SSH agent process. An attacker who has access to speak the agent protocol locally on the host machine or through forwarded connections can exploit this behavior by sending crafted add-key requests containing numerous lifetime constraints. By repeatedly triggering the allocation of tasks without subsequent cleanup upon parsing errors, the attacker can rapidly exhaust available system memory and task handles. This resource starvation eventually causes the SSH agent process to become unresponsive or terminate entirely, thereby denying service to legitimate users who rely on the agent for key management and authentication operations. The impact is particularly severe in environments where the SSH agent runs with elevated privileges or manages multiple keys, as the degradation of its functionality can disrupt broader security workflows dependent on secure key storage and signing capabilities.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting through excessive resource allocation without proper cleanup mechanisms upon error conditions. In terms of offensive cyber operations, this technique corresponds to ATT&CK tactic T1499, Endpoint Denial of Service, where the attacker aims to degrade or disrupt the availability of system resources rather than compromising confidentiality or integrity directly. The exploitation vector typically falls under local privilege escalation scenarios if combined with other vulnerabilities, but in isolation, it serves as a reliable method for disrupting authentication infrastructure.
To mitigate this risk, organizations utilizing russh must ensure that all instances are upgraded to version 0.64.1 or later, where the logic has been corrected to properly handle parsing failures and clean up allocated resources. For systems unable to immediately patch, implementing strict rate limiting on SSH agent requests can help throttle the frequency of add-key operations performed by any single client session. Additionally, monitoring system metrics for unusual spikes in memory usage associated with ssh-agent processes may provide early detection indicators of such an attack in progress. Developers integrating russh should also review their own implementations to ensure that external inputs governing resource allocation are validated before spawning long-lived tasks, adhering to the principle of fail-secure design where partial failures do not leave residual resources allocated.