{"id":"ghsa-ghsa-4wc5-f2rc-q74m","seq":2439,"kind":"advisory","title":"russh: Unbounded memory allocation in agent protocol server via crafted constraint records","url":"https://github.com/advisories/GHSA-4wc5-f2rc-q74m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4wc5-f2rc-q74m","summary":"影響: rust:russh <= 0.64.0 → 0.64.1\nSummary russh_keys::agent::server::add_key (russh/src/keys/agent/server.rs:271-319) spawns a dedicated tokio task for every 5-byte SSH_AGENT_CONSTRAIN_LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and…","severity":"medium","techs":["rust"],"cves":["CVE-2026-111061"],"tags":["GHSA-4wc5-f2rc-q74m","russh"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T17:06:46.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}