russh CVE-2026-111061

The target must run russh (<= 0.64.0) as an SSH agent server, and the attacker must be able to speak the agent protocol to it. Two concrete paths qualify: (1) a local process with access to the agent's unix socket, or (2) a remote SSH server the victim connects to with agent forwarding enabled - russh clients accept the auth-agent@openssh.com channel by default (russh/src/client/mod.rs:2686). The specific trigger is an SSH_AGENTC_ADD_IDENTITY_CONSTRAINED request carrying many SSH_AGENT_CONSTRAIN_LIFETIME records. Limiting factors: no code execution or data disclosure is possible (availability-only), exploitation requires either local socket access or victim-initiated agent forwarding to an attacker-controlled endpoint, and hosts not using russh's agent server or not forwarding agents are unaffected.

This is a medium-severity denial-of-service issue, and the available signals are consistent in pointing to a bounded, non-critical risk. The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 4.3) limits impact to availability only (A:L) with no confidentiality or integrity effect, which matches the CWE-770 (unbounded resource allocation) classification and the described memory/task exhaustion. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; exploitation status is best described as 'publicly available exploit code exists' because the GHSA advisory includes a working, measured proof-of-concept (10.2 MiB of traffic producing ~2,096,120 tasks and +1.4 GiB RSS at ~141x amplification). The main nuance is the attack vector: CVSS encodes AV:A (adjacent), but the advisory describes two distinct paths - a local process reaching the agent socket (local) and a remote SSH server exploiting a client that uses agent forwarding (effectively remote-via-forwarded-channel). The realistic priority is moderate: easy and reliable to trigger where it applies, but confined to availability of the SSH agent process and gated on either local socket access or the victim using agent forwarding to an attacker-controlled server. Treat as a 'patch in normal cycle' issue rather than an emergency, prioritizing hosts that use russh-based agents with forwarding enabled.

A user connects with a russh-based SSH client that has agent forwarding enabled to a malicious or compromised server; russh clients accept the auth-agent@openssh.com channel by default. The server repeatedly sends crafted SSH_AGENTC_ADD_IDENTITY_CONSTRAINED messages packed with many SSH_AGENT_CONSTRAIN_LIFETIME records, each spawning a long-lived task and cloning the key blob, until the agent process exhausts memory and task capacity and is starved or killed. A working, measured proof-of-concept is published in the GHSA advisory.