Eugeny russh up to 0.2.4 PageantStream pageant/src/wmmessage.rs PageantStream::new memory allocation

Summaryinfo

A vulnerability categorized as problematic has been discovered in Eugeny russh up to 0.2.4. This impacts the function PageantStream::new of the file pageant/src/wmmessage.rs of the component PageantStream. Such manipulation leads to memory allocation. This vulnerability is listed as CVE-2026-116775. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Eugeny russh up to 0.2.4 and classified as problematic. Affected by this issue is the function PageantStream::new of the file pageant/src/wmmessage.rs of the component PageantStream. The manipulation with an unknown input leads to a memory allocation vulnerability. Using CWE to declare the problem leads to CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. Impacted is availability. CVE summarizes:

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-116775 since 10/26/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 0.2.5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Eugeny

Name

• russh

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4

Website

• Product: https://github.com/Eugeny/russh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion