{"schema":"threatline.record/2","record":{"id":"CVE-2026-116696","aliases":["GHSA-9wfm-jcj8-jfv9"],"summary":"russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages","details":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.","categories":["Unclassified"],"product":"russh","vendor":"Eugeny","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116696","source_modified_at":"2026-10-27T20:14:32.973Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"russh","vendor":"Eugeny","versions":[{"version":"< 0.65.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":3.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T20:14:32.973Z","modified_at":"2026-10-27T20:14:32.973Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116696","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T20:14:32.973Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/Eugeny/russh/releases/tag/v0.65.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T20:14:32.973Z","content_hash":"9974ffa3fecd22b47f46808f7087f7784bb9429139fd114fba1dd6de5378baa8"}}