High severity7.5GHSA Advisory· Published Jun 10, 2026· Updated Jun 11, 2026
CVE-2026-46673
CVE-2026-46673
Description
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
russh-cryptoveccrates.io | < 0.60.3 | 0.60.3 |
russhcrates.io | < 0.60.3 | 0.60.3 |
Affected products
5- osv-coords4 versions
< 26.5.6-r1+ 3 more
- (no CPE)range: < 26.5.6-r1
- (no CPE)range: < 26.5.6-r1
- (no CPE)range: < 0.60.3
- (no CPE)range: < 0.60.3
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.