CVE-2026-46673

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.

• CWE-770

• https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5
• https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46668SpiceDB is an open source database system for creating and m…2.3
• CVE-2026-46669OpenVM is a performant and modular zkVM framework built for …7.5
• CVE-2026-4667HP System Optimizer might potentially be vulnerable to escal…7.3
• CVE-2026-46670YesWiki is a wiki system written in PHP. Prior to version 4.…9.8
• CVE-2026-46671Rust OneNote File Parser is a parser for Microsoft OneNote f…4.4
• CVE-2026-46672Actual is a local-first personal finance app. Prior to 26.6.…4.6
• CVE-2026-46678Pydantic AI is a Python agent framework for building Generat…5.9
• CVE-2026-46679libp2p is a JavaScript Implementation of libp2p networking s…7.5
• CVE-2026-4668The Booking for Appointments and Events Calendar - Amelia pl…6.5
• CVE-2026-46680containerd is an open-source container runtime. In versions …7.8
• CVE-2026-46681@nevware21/ts-utils is a comprehensive TypeScript/JavaScript…7.2
• CVE-2026-46683Snappy is a PHP library allowing thumbnail, snapshot or PDF …6.9