CVE-2026-102821 · GHSA-35g8-35p8-c8fw
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
- Risk score
- 48/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. T…
- Affected
- russh (rust) <= 0.63.1
- Fix
- Upgrade russh to 0.63.2 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
russh: Yellow, plan it in. Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xof…
The flaws
- CVE-2026-102821: Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey (CVSS 6.5 · EPSS 0%)
- CVE-2026-102823: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened (CVSS 7.5 · EPSS 0%)
The fix
Upgrade russh: 0.63.2 · 0.63.1 or later on your release line
Who is exposed: russh (rust) <= 0.63.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| russh | rust | <= 0.63.1 | 0.63.2 |
References
- https://github.com/advisories/GHSA-35g8-35p8-c8fw
- https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw
- https://nvd.nist.gov/vuln/detail/CVE-2026-102821
- https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b
- https://github.com/Eugeny/russh/releases/tag/v0.63.2
- https://github.com/advisories/GHSA-35g8-35p8-c8fw
Original description
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.
Last activity 29 Sep 2026. Patch Forecast updates every hour.