CVE-2026-48110
Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds
7.5
HIGH
CVSS 3.1
描述
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.
如何修補 CVE-2026-48110
要修補 CVE-2026-48110,請將受影響套件升級到下列已修補版本。
- —升級至 0.61.0 或更新版本
- —未列出修補版本
CVE-2026-48110 正在被利用嗎?
目前沒有被利用訊號。CVE-2026-48110 既不在 CISA KEV 也沒有最新的 EPSS 分數。
受影響套件(2)
- >= 0.34.0, < 0.61.0
- from 0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |