{"cve":"CVE-2026-46673","nvd":{"published":"2026-06-10T22:17:00.167","modified":"2026-07-23T09:10:00.113","status":"Deferred","description":"Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770"],"references":["https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5","https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-46673","score":0.00263,"percentile":0.18126,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-g9f8-wqj9-fjw5","url":"https://osv.dev/vulnerability/GHSA-g9f8-wqj9-fjw5","summary":"Russh: Unchecked CryptoVec allocation and growth handling is reachable","modified":"2026-09-10T03:51:05.593041447Z","packages":[{"ecosystem":"crates.io","name":"russh-cryptovec","purl":"pkg:cargo/russh-cryptovec","ranges":["<0.60.3"],"fixed":["0.60.3"]},{"ecosystem":"crates.io","name":"russh","purl":"pkg:cargo/russh","ranges":["<0.60.3"],"fixed":["0.60.3"]}]},{"id":"RUSTSEC-2026-0153","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0153","summary":"Unchecked `CryptoVec` allocation and growth handling","modified":"2026-10-12T18:00:09.237854178Z","packages":[{"ecosystem":"crates.io","name":"russh-cryptovec","purl":"pkg:cargo/russh-cryptovec","ranges":[">=0.0.0-0 <0.60.3"],"fixed":["0.60.3"]}]},{"id":"RUSTSEC-2026-0154","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0154","summary":"Unbounded 32-bit allocation","modified":"2026-10-12T18:00:13.569892882Z","packages":[{"ecosystem":"crates.io","name":"russh","purl":"pkg:cargo/russh","ranges":[">=0.0.0-0 <0.60.3"],"fixed":["0.60.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}