russh EUVD-2026-111388

The victim must initiate and maintain an SSH connection using the russh client library at a version below 0.65.0 to a server the attacker controls or has compromised; per the advisory this remains exploitable even after the client has verified the server's host key. No special client configuration is required: russh routes its private EXT_INFO message number 7 to handle_ext_info unconditionally in the pre-authentication states (WaitingAuthServiceRequest and WaitingAuthRequest), and the read-limit-based automatic rekey throttle only engages after authentication, so no pre-auth budget applies. The standards-compliant EXT_INFO number 82 is not processed by this handler, so the attack specifically relies on the server speaking russh's private number 7. Limiting factors: exploitation requires the user/application to connect to the hostile server (UI:R) and the session to stay alive for memory to grow; impact is limited to availability (memory exhaustion) with no code execution, data disclosure, or integrity impact. The only complete fix stated by the vendor is upgrading to 0.65.0.

This is a moderate-severity availability-only issue (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, CWE-770 unbounded resource allocation) and the signals are internally consistent rather than conflicting. The vendor priority label is this_month, not act_now/emergency, which matches a non-critical DoS. The attack vector is network but the real precondition is that the client must connect to a malicious or compromised SSH server (reflected in UI:R), so this is not a server-side remotely-reachable flaw that attackers can spray against exposed infrastructure - it is a client-trust problem that bites applications embedding russh as an SSH client. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation; a verified reproduction harness is published in the GitHub Security Advisory, which raises reproducibility but is distinct from in-the-wild use. Net: a legitimate but not urgent priority - patch within the vendor's this_month window. Impact is confined to availability (progressive memory exhaustion of the client process over the session lifetime); there is no confidentiality or integrity impact. Note the 'unauthenticated' framing (PR:N) is correct but should be read in context: the attacker is the server peer, which for a client library is the inherent threat position, and the advisory states this remains exploitable even after the client verifies the server host key.

An application that uses russh (< 0.65.0) as an SSH client connects to a server the attacker controls or has compromised. During the pre-authentication phase the malicious server repeatedly sends russh's private EXT_INFO message (message number 7), each packet carrying thousands of extension names, which the client appends to its per-session received_extensions vector without any cap, dedup, or trimming - progressively exhausting the client's memory for as long as the session lives. A verified reproduction harness (driving the real Session::process_packet path) is published in the GitHub Security Advisory.