CVE-2026-46702: Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

Synopsis

An uncontrolled decompression vulnerability (sometimes called a zip-bomb or decompression-bomb attack) affects the Russh Rust SSH library versions 0.34.0 through 0.61.0. The flaw is reachable over the network by any unauthenticated remote peer when SSH compression is enabled: a crafted compressed packet passes the normal on-wire size check but expands to an arbitrarily large buffer after decompression. Successful exploitation exhausts server memory or CPU, crashing or hanging the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SSH service over the network; no local access or physical presence is needed.

• AuthenticationNot required

  No credentials or prior session are needed; the oversized compressed packet can be sent by any remote peer before authentication completes.

• Victim interactionNot required

  No user action is required; the server processes the malicious packet passively during normal SSH handshake or session handling.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the service is reachable with compression enabled; no race conditions or special memory layout is required.

Blast Radius

• Exhausts available memory on the host running the russh-based SSH server or client, forcing an out-of-memory kill or process crash.
• Saturates CPU during decompression of the oversized payload, starving other processes on the same host.
• Renders the SSH service unavailable, blocking any administrative or automated access that depends on it.
• On russh versions before 0.58.0, the decompression path used CryptoVec, which may allow additional or more severe resource corruption beyond plain memory exhaustion.