CVE-2026-46702

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path. In older releases before 0.58.0, the same remote decompression path used CryptoVec, which appears to make the historical impact worse. This issue has been patched in version 0.61.1.

• CWE-770

• https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259
• https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46697Fediverse Embeds embeds fediverse posts on WordPress sites. …7.5
• CVE-2026-46698Fediverse Embeds embeds fediverse posts on WordPress sites. …5.3
• CVE-2026-46699conda-smithy is a tool for combining a conda recipe with con…7.6
• CVE-2026-4670Authentication bypass by primary weakness vulnerability in P…9.8
• CVE-2026-46700Actual is a local-first personal finance tool. Prior to 26.6…4.3
• CVE-2026-46701Network-AI is a TypeScript/Node.js multi-agent orchestrator.…7.6
• CVE-2026-46703Boxlite is a sandbox service that allows users to create lig…9.6
• CVE-2026-46705Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-46709Tabby (formerly Terminus) is a highly configurable terminal …7.8
• CVE-2026-46710Notepad++ is a free and open-source source code editor. From…7.8
• CVE-2026-46712Misskey is an open source, federated social media platform. …2.3
• CVE-2026-46713Misskey is an open source, federated social media platform. …9.2