Description
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eugeny | russh | < 0.60.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-russh | 0.64.1-1 | — |
| Debian 14 | rust-russh-cryptovec | 0.62.0-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | yazi | 26.5.6-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | russh | < 0.60.3 | 0.60.3 | GHSA-g9f8-wqj9-fjw5 |
| crates.io | russh | >= 0.0.0-0, < 0.60.3 | 0.60.3 | RUSTSEC-2026-0154 |
| crates.io | russh-cryptovec | < 0.60.3 | 0.60.3 | GHSA-g9f8-wqj9-fjw5 |
| crates.io | russh-cryptovec | >= 0.0.0-0, < 0.60.3 | 0.60.3 | RUSTSEC-2026-0153 |