Security
فارسی
All products

russh

Rust / Cargo · Package
26 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetsCVE-2026-46702 · GHSA-WWX6-X28X-8259 russh Rust / Cargo High Fix reported
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116794 · GHSA-VP5Q-FF62-JWQV russhRed Hat Hardened Images/openshell Rust / CargoRed Hat High Fix reported
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesCVE-2026-116696 · GHSA-9WFM-JCJ8-JFV9 russhRed Hat Hardened Images/openshell Rust / CargoRed Hat Low Fix reported
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsCVE-2026-116773 · GHSA-4P9F-7P9M-5VFG russhRed Hat Hardened Images/openshell Rust / CargoRed Hat Medium Fix reported
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)CVE-2026-116774 · GHSA-FW5C-8223-6H42 russhRed Hat Hardened Images/openshell Rust / CargoRed Hat Medium Fix reported
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestCVE-2026-111062 · GHSA-J7H2-66J4-GHJF russh Rust / Cargo Low Fix reported
russh: Unbounded memory allocation in agent protocol server via crafted constraint recordsCVE-2026-111061 · GHSA-4WC5-F2RC-Q74M russhRed Hat Hardened Images/openshell Rust / CargoRed Hat Medium Fix reported
Russh: Unchecked CryptoVec allocation and growth handling is reachableCVE-2026-46673 · GHSA-G9F8-WQJ9-FJW5Version ranges need review. russh-cryptovecrussh Rust / Cargo High Fix reported
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyCVE-2026-102821 · GHSA-35G8-35P8-C8FW russh Rust / Cargo Medium Fix reported
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicCVE-2026-102822 · GHSA-P8QX-H547-FJW9 russh Rust / Cargo Low Fix reported
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedCVE-2026-102823 · GHSA-47HW-GVQ5-R2GM russh Rust / Cargo High Fix reported
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeCVE-2026-102824 · GHSA-W3JG-PJXF-73P4 russh Rust / Cargo Medium Fix reported
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathCVE-2026-102825 · GHSA-G6XM-F9XP-QQ35 russh Rust / Cargo Low Fix reported
Russh: Channel-scoped server callbacks can be reached without an open channelCVE-2026-68930 · GHSA-M65R-RPRJ-R5RG russh Rust / Cargo Medium Fix reported
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsCVE-2026-73489 · GHSA-CQJC-RMPQ-XPRQ russh Rust / Cargo Medium Fix reported
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)CVE-2026-73430 · GHSA-5XVQ-CP9X-6P6R russh Rust / Cargo Medium Fix reported
russh server userauth state is not reset when authentication principal changesCVE-2026-46705 · GHSA-HPV4-5H6F-WQR3 russh Rust / Cargo Medium Fix reported
russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handlerCVE-2026-42189 · GHSA-F5V4-2WR6-HQMG russh Rust / Cargo High Fix reported
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)CVE-2026-73429 · GHSA-G9HV-X236-4QP3 russh Rust / Cargo Medium Fix reported
russh is missing overflow checks during channel windows adjustCVE-2025-54804 · GHSA-H5RC-J5F5-3GCM russhRed Hat OpenShift Dev Spaces/devspaces-tech-preview/idea-rhel9 Rust / CargoRed Hat Medium Fix reported