CVE-2026-116696
Description
A flaw was found in russh. This vulnerability can lead to a Denial of Service (DoS) due to unbounded memory consumption in the SSH agent service. A local process or a remote user with access to a forwarded agent socket can repeatedly submit keys containing an excessive number of confirmation constraint records. Because the agent stores these records without enforcing memory or count limits, memory usage grows continuously for the lifetime of the process, potentially exhausting system resources.
Statement
This vulnerability is rated as Low severity because exploitation requires direct access to the local agent socket or a compromised remote endpoint in an active forwarded session, limiting the flaw's scope solely to process availability. An unauthorized party cannot obtain sensitive cryptographic key material or compromise system integrity through this mechanism. Furthermore, standard configurations do not forward SSH agents to untrusted destinations, constraining exposure to specific scenarios where forwarding is explicitly configured.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | 3.3 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
