Threats affecting pkg:cargo/pageant

The pageant crate's PageantStream component improperly handles a 4-byte length prefix from its input stream without validating the claimed frame size. This allows a malicious peer to claim an oversized frame (up to ~4 GiB) and cause unbounded memory buffering, leading to a remote memory-exhaustion denial-of-service (DoS) on the client process. The vulnerability affects versions from 0.2.0 up to but not including 0.2.5. A fix is available in version 0.2.5 that rejects frames exceeding the transport's maximum size before buffering.

CVE-2026-102820 is an out-of-bounds read vulnerability in the Windows pageant crate used by Eugeny's russh library. The flaw exists in the MemoryMap::read function prior to pageant version 0.2.3, where a peer-controlled 32-bit response length is trusted, allowing a local process impersonating the Pageant window to cause a large memory allocation and read beyond the mapped memory. This can crash the russh client and potentially expose adjacent committed memory. The issue is fixed in pageant 0.2.3.