Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

russh

25 known vulnerabilities (7 high, 15 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
0.65.1 (Nov 3, 2026): no advisory affects it
Newest unaffected release
0.65.1 (Nov 3, 2026), the latest release
Advisories
25 · 7 high, 15 medium, 3 low
Weekly downloads
323.2K
Dependents
0
Releases
134 since 0.34.0 (Nov 4, 2022)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

Show all 25 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 25

  • russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

    Affected: fixed in 0.65.

    Fixed in 0.65.0 (released Oct 25, 2026, 3 days before disclosure).

    The latest release, 0.65.1, is not affected.

    95% of russh downloads in the last 90 days were affected versions (4.2M).

  • CVE-2026-116774Medium 4.3

    russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

    Affected: from 0.60.0, fixed in 0.65.

    Fixed in 0.65.0 (released Oct 25, 2026, 2 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-116773Medium 4.3

    russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

    Affected: fixed in 0.65.

    Fixed in 0.65.0 (released Oct 25, 2026, 2 days before disclosure).

    The latest release, 0.65.1, is not affected.

    95% of russh downloads in the last 90 days were affected versions (4.2M).

  • russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

    Affected: fixed in 0.65.0.

    Fixed in 0.65.0 (released Oct 25, 2026, 2 days before disclosure).

    The latest release, 0.65.1, is not affected.

    95% of russh downloads in the last 90 days were affected versions (4.2M).

  • CVE-2026-111061Medium 4.3

    russh agent server converts constraint records into unbounded never-rolled-back tasks

    Affected: fixed in 0.64.1.

    Fixed in 0.64.1 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 0.65.1, is not affected.

    81% of russh downloads in the last 90 days were affected versions (3.6M).

  • Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

    Affected: fixed in 0.62.6.

    Fixed in 0.62.6 (released Aug 11, 2026, 49 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-102824Medium 4.3

    Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

    Affected: fixed in 0.63.0.

    Fixed in 0.63.0 (released Aug 21, 2026, 39 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

    Affected: fixed in 0.63.1.

    Fixed in 0.63.1 (released Aug 23, 2026, 37 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

    Affected: fixed in 0.63.1.

    Fixed in 0.63.1 (released Aug 23, 2026, 37 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-102821Medium 6.5

    Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

    Affected: fixed in 0.63.2.

    Fixed in 0.63.2 (released Sep 3, 2026, 26 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-73489Medium 4.3

    Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

    Affected: fixed in 0.62.4.

    Fixed in 0.62.4 (released Jul 22, 2026, 22 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-73430Medium 5.3

    Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

    Affected: fixed in 0.62.4.

    Fixed in 0.62.4 (released Jul 22, 2026, 21 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-73429Medium 5.3

    Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

    Affected: fixed in 0.62.4.

    Fixed in 0.62.4 (released Jul 22, 2026, 21 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-68930Medium 6.5

    Russh: Channel-scoped server callbacks can be reached without an open channel

    Affected: fixed in 0.62.5.

    Fixed in 0.62.5 (released Jul 31, 2026, 3 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds

    Affected: from 0.34.0, fixed in 0.61.0.

    Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure).

    The latest release, 0.65.1, is not affected.

Show all 25 advisoriesShow fewer advisories
  • CVE-2026-48108Medium 5.3

    Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

    Affected: from 0.34.0-beta.1, fixed in 0.61.0.

    Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-48107Medium 6.5

    Russh: Unchecked keyboard-interactive prompt count in client auth path

    Affected: from 0.37.0, fixed in 0.61.0.

    Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2026-46705Medium 5.3

    russh server userauth state is not reset when authentication principal changes

    Affected: from 0.34.0-beta.1, fixed in 0.61.0.

    Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

    Affected: from 0.34.0, fixed in 0.61.1.

    Fixed in 0.61.1 (released May 23, 2026, 18 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote…

    Affected: fixed in 0.60.3; fixed in 0.60.3.

    Fixed in 0.60.3 (released May 15, 2026, 26 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth

    Affected: fixed in 0.60.1.

    Fixed in 0.60.1 (released Apr 20, 2026, 18 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2025-54804Medium 6.5

    Russh is missing an overflow check during channel windows adjust

    Affected: fixed in 0.54.1.

    Fixed in 0.54.1 (released Aug 4, 2025, 1 day before disclosure).

    The latest release, 0.65.1, is not affected.

  • Russh has an OOM Denial of Service due to allocation of untrusted amount

    Affected: fixed in 0.44.1.

    Fixed in 0.44.1 (released Aug 14, 2024, 7 days before disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2023-48795Medium 5.9

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas

    Affected: fixed in 0.40.2.

    Fixed in 0.40.2 (released Dec 18, 2023, the day of disclosure).

    The latest release, 0.65.1, is not affected.

  • CVE-2023-28113Medium 5.9

    russh may use insecure Diffie-Hellman keys

    Affected: fixed in 0.36.2; from 0.37.0, fixed in 0.37.1.

    Fixed in 0.36.2 (released Mar 16, 2023, the day of disclosure) and 0.37.1 (released Mar 16, 2023, the day of disclosure).

    The latest release, 0.65.1, is not affected.