russh: Unbounded memory allocation in agent protocol server via crafted constraint records

影響: rust:russh <= 0.64.0 → 0.64.1

russh_keys::agent::server::add_key (russh/src/keys/agent/server.rs:271-319) spawns a dedicated tokio task for every 5-byte SSH_AGENT_CONSTRAIN_LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and…

GitHub Advisory Databaseで読む

2026/10/20 02:06、GitHub Advisory Databaseが「russh: Unbounded memory allocation in agent protocol server via crafted constraint records」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Rust。CVE: CVE-2026-111061。