russh: Unbounded memory allocation in SSH agent via crafted constraints

The russh SSH agent server spawns unbounded tokio tasks for constraint records, allowing attackers to cause memory exhaustion through 141x amplification with crafted add-key messages. An attacker with access to the agent socket or via SSH agent forwarding can exhaust the agent process's memory and task capacity.

Disclosed 19 October 2026 · Record updated 19 October 2026

Impact

Memory exhaustion and task capacity exhaustion in SSH agent process; ~2.1M live tasks and ~1.45GB RSS growth from ~10MB of input traffic.

Our coverage

A sponge absorbs seawater endlessly, swelling beyond its limits until it ruptures, draining a lighthouse's power supply.

Vulnerabilities

russh SSH agent flaw lets attackers exhaust memory

A disclosed vulnerability in the russh library lets an agent peer convert megabytes of traffic into gigabytes of memory use, crashing the key agent.

19 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-4wc5-f2rc-q74m