CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.

• CWE-400
• CWE-770

• https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b
• https://github.com/Eugeny/russh/releases/tag/v0.63.2
• https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102809PX4 Autopilot through 1.17.0 contains an uncontrolled stack …6.5
• CVE-2026-10281A weakness has been identified in Enderfga claw-orchestrator…7.3
• CVE-2026-102810Marmite through 0.4.2 contains a path traversal vulnerabilit…7.5
• CVE-2026-102811Marmite through 0.4.2 contains missing authentication in the…7.5
• CVE-2026-10282A security vulnerability has been detected in Bottelet Dayby…5.3
• CVE-2026-102820pageant provides a [PageantStream] type that implements [Asy…6.2
• CVE-2026-102822Russh is a Rust SSH client and server library. Prior to 0.63…3.7
• CVE-2026-102823Russh is a Rust SSH client and server library. Prior to 0.63…7.5
• CVE-2026-102824Russh is a Rust SSH client and server library. Prior to 0.63…4.3
• CVE-2026-102825Russh is a Rust SSH client and server library. Prior to 0.62…3.7
• CVE-2026-102826simple-git, an interface for running git commands in any nod…8.1
• CVE-2026-102827simple-git, an interface for running git commands in any nod…8.1