crates.io/russh CVE-2026-111061: medium 4.3

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

Action: Upgrade russh to 0.64.1 or later.

cargo update -p russh --precise 0.64.1

Affected

Fixed versions

Sources

• osv: GHSA-4wc5-f2rc-q74m
• https://github.com/Eugeny/russh/security/advisories/GHSA-4wc5-f2rc-q74m
• https://github.com/Eugeny/russh/commit/4c305033d72f8e5dd21a3fd4c53a6c291a16ebd1
• https://github.com/Eugeny/russh
• https://github.com/Eugeny/russh/releases/tag/v0.64.1

CVE-2026-111061 · published 2026-10-19T17:06:46Z · modified 2026-10-19T17:15:04.083911581Z · JSON