| russh kex_done: Shared-secret callback runs before server host-key verificationCVE-2026-128087 · GHSA-9264-JVGF-6W2F |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
کم
|
اصلاح گزارش شده |
|
| russh try_sign: asynchronous confirmation can sign after agent lockCVE-2026-128088 · GHSA-736F-C93Q-9FWX |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
کم
|
اصلاح گزارش شده |
|
| russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetsCVE-2026-46702 · GHSA-WWX6-X28X-8259 |
russh |
Rust / Cargo |
زیاد
|
اصلاح گزارش شده |
|
| russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116794 · GHSA-VP5Q-FF62-JWQV |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesCVE-2026-116696 · GHSA-9WFM-JCJ8-JFV9 |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
کم
|
اصلاح گزارش شده |
|
| russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsCVE-2026-116773 · GHSA-4P9F-7P9M-5VFG |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)CVE-2026-116774 · GHSA-FW5C-8223-6H42 |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestCVE-2026-111062 · GHSA-J7H2-66J4-GHJF |
russh |
Rust / Cargo |
کم
|
اصلاح گزارش شده |
|
| russh: Unbounded memory allocation in agent protocol server via crafted constraint recordsCVE-2026-111061 · GHSA-4WC5-F2RC-Q74M |
russhRed Hat Hardened Images/openshell |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Russh: Unchecked CryptoVec allocation and growth handling is reachableCVE-2026-46673 · GHSA-G9F8-WQJ9-FJW5بازه‌ها نیاز به بررسی دارند. |
russh-cryptovecrussh |
Rust / Cargo |
زیاد
|
اصلاح گزارش شده |
|
| Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyCVE-2026-102821 · GHSA-35G8-35P8-C8FW |
russh |
Rust / Cargo |
متوسط
|
اصلاح گزارش شده |
|
| russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicCVE-2026-102822 · GHSA-P8QX-H547-FJW9 |
russh |
Rust / Cargo |
کم
|
اصلاح گزارش شده |
|
| russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedCVE-2026-102823 · GHSA-47HW-GVQ5-R2GM |
russh |
Rust / Cargo |
زیاد
|
اصلاح گزارش شده |
|
| Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeCVE-2026-102824 · GHSA-W3JG-PJXF-73P4 |
russh |
Rust / Cargo |
متوسط
|
اصلاح گزارش شده |
|
| Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathCVE-2026-102825 · GHSA-G6XM-F9XP-QQ35 |
russh |
Rust / Cargo |
کم
|
اصلاح گزارش شده |
|
| Russh: Channel-scoped server callbacks can be reached without an open channelCVE-2026-68930 · GHSA-M65R-RPRJ-R5RG |
russh |
Rust / Cargo |
متوسط
|
اصلاح گزارش شده |
|
| Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsCVE-2026-73489 · GHSA-CQJC-RMPQ-XPRQ |
russh |
Rust / Cargo |
متوسط
|
اصلاح گزارش شده |
|
| Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)CVE-2026-73430 · GHSA-5XVQ-CP9X-6P6R |
russh |
Rust / Cargo |
متوسط
|
اصلاح گزارش شده |
|
| russh server userauth state is not reset when authentication principal changesCVE-2026-46705 · GHSA-HPV4-5H6F-WQR3 |
russh |
Rust / Cargo |
متوسط
|
اصلاح گزارش شده |
|
| russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handlerCVE-2026-42189 · GHSA-F5V4-2WR6-HQMG |
russh |
Rust / Cargo |
زیاد
|
اصلاح گزارش شده |
|
