CVE-2026-48110: Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds

Synopsis

This is a memory allocation denial-of-service vulnerability in the Russh Rust SSH library (versions 0.34.0 through 0.60.x). A remote attacker with no authentication can send specially crafted SSH messages containing oversized or malformed length-prefixed fields, causing the library to allocate or attempt to allocate large amounts of memory before rejecting the input. Successful exploitation crashes or exhausts resources in any service built on Russh, disrupting availability entirely. No fix version has been published upstream yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SSH service over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials or account are needed; the malformed messages can be sent before any authentication handshake completes.

• Victim interactionNot required

  No action by a legitimate user is required; the attacker interacts directly with the SSH listener.

• Attack complexityDetail

  Exploitation is reliable and condition-free; crafting an oversized or malformed length-prefixed field requires no special timing or environmental setup.

Blast Radius

• The affected SSH service process exhausts available memory or crashes outright, taking down any functionality it provides.
• All in-flight SSH sessions handled by the same process are terminated, disconnecting legitimate clients.
• Repeated short bursts of malformed messages can sustain a denial-of-service condition with minimal attacker bandwidth.