Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

RUSTSEC-2026-0153

HighCVSS 7.5 / 10
Published May 15, 2026·Last modified Jun 2, 2026
Affected Components(0)

No affected components available

Description

CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation and locking paths. In affected russh releases, attacker-controlled input could reach these code paths through buffer resizing operations.

Two affected reachability paths were identified:

  • Current russh releases (0.60.x before the fix) Local SSH agent peers could provide attacker-controlled frame lengths that were used to resize internal buffers before validation in:

    • AgentClient::read_response
    • agent::server::Connection::run

  • Historical russh releases before 0.58.0 CryptoVec was also used for non-secret transport and compression buffers, allowing remote SSH traffic to trigger CryptoVec growth through:

    • transport packet reads
    • zlib decompression output

These remote paths were removed in 0.58.0 when CryptoVec stopped being used for those buffers.

Under constrained memory conditions, historical russh versions prior to 0.58.0 can abort the process when remote compressed payload expansion causes allocation failure in CryptoVec. This was reproduced through the compression path and resulted in process termination in the Unix allocation/locking implementation after null pointer allocation failure.

For current affected releases, oversized local SSH agent frame lengths could trigger untrusted-input-driven buffer growth prior to validation.

No practical remote code execution, integrity or confidentiality impact has been demonstrated.

Fixed by validating CryptoVec growth operations and rejecting oversized SSH agent frame lengths before buffer allocation.

Risk Scores
Base Score
7.5

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the availability of the system.

Threat Intelligence
6.9

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
0.26%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

High severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard