russh SSH agent EUVD-2026-111387

Requires that the russh SSH-agent server (russh::keys::agent::server::serve) is actually running and reachable, and that the attacker's process can connect to its listening socket; in agent-forwarding deployments this includes processes on the remote end of a forwarded session. The attacker must be able to issue key-addition requests (PR:L). Affected only on russh versions prior to 0.65.0. Limiting factors that reduce real-world risk: impact is availability-only (no data exposure or code execution), the socket must be locally reachable or exposed via agent forwarding rather than network-facing by default, and memory growth is gradual and bounded per request by the 256 KiB agent frame cap (amplified ~48x per request), so exhausting a host requires sustained repeated requests.

This is a low-severity, availability-only denial-of-service issue (CWE-770, unbounded resource allocation), and the signals are internally consistent rather than conflicting. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 3.3) indicates a local attack vector with low attacker privilege and no confidentiality or integrity impact - only an availability effect from unbounded memory growth. The vuln.today decision label is 'monitor', which aligns with the low CVSS. The issue is NOT in CISA KEV (not actively exploited) and no EPSS exploitation-probability score was supplied in the input, so widespread opportunistic exploitation cannot be quantified from the data given. A detailed proof-of-concept is present: the GHSA advisory embeds full working harness code that the reporter states was run against an unmodified russh v0.64.1 agent server (measuring ~72.4 MiB retained after six 256 KiB requests, ~48x amplification). Net judgment: a real but low-priority bug - the local/forwarded-socket prerequisite (PR:L, AV:L) and availability-only impact keep real-world risk modest, matching the 'monitor' triage rather than an emergency. The one nuance to verify operationally is reach: russh sets S:U (scope unchanged), yet in agent-forwarding deployments the trigger can originate from the remote side of a forwarded session, which effectively widens who can connect to the agent socket.

An attacker who can reach the russh agent's listening socket - including a process on the remote side of a forwarded agent session - repeatedly sends SSH_AGENTC_ADD_IDENTITY_CONSTRAINED requests packed with many 1-byte SSH_AGENT_CONSTRAIN_CONFIRM (0x02) records. Each record is retained as a 56-byte Constraint::Confirm enum in the keystore and, because keys without a lifetime constraint never expire, the memory is never reclaimed; the attacker renews the growth at will until the host process is exhausted. A full, reportedly-verified PoC harness is published in the GHSA advisory.