{"action":"Upgrade russh to 0.64.1 or later.","affected":[{"fixed":"0.64.1","introduced":"0"}],"component":"russh","cve_ids":["CVE-2026-111061"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.64.1"],"ghsa_id":"GHSA-4wc5-f2rc-q74m","id":"tcs_01M5JHJQE211P4M8V5Z13RMYST","modified_at":"2026-10-19T17:15:04.083911581Z","published_at":"2026-10-19T17:06:46Z","references":["https://osv.dev/vulnerability/GHSA-4wc5-f2rc-q74m","https://github.com/Eugeny/russh/security/advisories/GHSA-4wc5-f2rc-q74m","https://github.com/Eugeny/russh/commit/4c305033d72f8e5dd21a3fd4c53a6c291a16ebd1","https://github.com/Eugeny/russh","https://github.com/Eugeny/russh/releases/tag/v0.64.1"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-4wc5-f2rc-q74m","url":"https://osv.dev/vulnerability/GHSA-4wc5-f2rc-q74m"}],"summary":"russh: Unbounded memory allocation in agent protocol server via crafted constraint records"}