{"affected":[{"product":"russh","source":"CNA: GitHub_M","vendor":"Eugeny","versions":[{"status":"affected","version":">= 0.2.0, < 0.2.5"}]},{"defaultStatus":"unaffected","ecosystem":"crates.io","packageName":"pageant","product":"pageant","source":"OSV GHSA-662x-8wvj-2276","vendor":"","versions":[{"events":[{"introduced":"0.2.0"},{"fixed":"0.2.5"}],"lessThan":"0.2.5","status":"affected","version":"0.2.0","versionType":"semver"}]}],"cveId":"CVE-2026-116775","cwes":["CWE-770"],"description":"pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.","epss":{"date":"2026-11-02","percentile":0.22009,"score":0.00294},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-662x-8wvj-2276"}],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793708054017,"publishedAt":1793132850852,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Eugeny/russh/security/advisories/GHSA-662x-8wvj-2276"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Eugeny/russh/commit/69e4b55513eaa8ac9d2ad4236f13171fc164e10a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Eugeny/russh/releases/tag/v0.65.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/Eugeny/russh/security/advisories/GHSA-662x-8wvj-2276"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-662x-8wvj-2276"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-662x-8wvj-2276"}],"remediation":[{"kind":"fix","source":"OSV GHSA-662x-8wvj-2276","text":"pageant (crates.io): OSV reports a fixed version 0.2.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-662x-8wvj-2276"}],"revision":"63145a27d0d767c903da5e716780a0a4a4ead4ca5e280891b377cd76e9ac906b","sources":[{"modifiedAt":1793708054017,"name":"CNA: GitHub_M","retrievedAt":1793711373969,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116775"},{"modifiedAt":1793402108228,"name":"OSV / GitHub Security Advisories","retrievedAt":1793711375818,"url":"https://osv.dev/vulnerability/GHSA-662x-8wvj-2276"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793711404811,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116775"}],"ssvc":{"assessedAt":1793708007129,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)","updatedAt":1793711404811}