CVE-2026-48110
Last modified
CVE-2026-48110 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48110?
How severe is CVE-2026-48110?
How do I fix CVE-2026-48110?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-481037-Zip is a file archiver with a high compression ratio. Vers…7.1
- CVE-2026-481047-Zip is a file archiver with a high compression ratio. Vers…4.2
- CVE-2026-48107Russh is a Rust SSH client & server library. From version 0.…6.5
- CVE-2026-48108Russh is a Rust SSH client & server library. From version 0.…5.3
- CVE-2026-48109MessagePack for C# is a MessagePack serializer for C#. Prior…8.2
- CVE-2026-4811The WPB Floating Menu & Categories for WordPress – Sticky Si…4.9
- CVE-2026-481117-Zip is a file archiver with a high compression ratio. Vers…7.1
- CVE-2026-481127-Zip is a file archiver with a high compression ratio. Vers…6.5
- CVE-2026-48113Chisel is a TCP/UDP tunnel, transported over HTTP and secure…8.5
- CVE-2026-48114Metacat is data repository software that helps researchers p…9.8
- CVE-2026-48115Misskey is an open source, federated social media platform. …6.3
- CVE-2026-48116AnythingLLM is an application that turns pieces of content i…8.8
Are you affected by CVE-2026-48110?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST