SZB-3b19708407
EUVD-2026-111388 lists SSH agent packet handling issue in russh
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Eugeny
- Product
- russh
- First seen
Summary
The EUVD listing, shared on Mastodon, describes a packet-handling issue in the russh Rust SSH library before 0.65.0 with a CVSS v3.1 score of 4.3. It says the client accepts repeated packets encoded in a particular way.
If you use Eugeny
Upgrade russh to 0.65.0 or later
Review Rust projects that depend on russh for client-side SSH use
What the sources say 1
· Mastodon: “Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's p” Source