# russh (crates.io) vulnerabilities 25 known vulnerabilities (7 high, 15 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.65.1 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 0.65.1 (Nov 3, 2026), the latest release - Weekly downloads: 323.2K - Dependents: 0 - Releases: 134 since 0.34.0 (Nov 4, 2022) - Registry: https://crates.io/crates/russh - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116794: 0.34.0-beta.1 to 0.64.1 (0.65.0 is outside it) - CVE-2026-116774: 0.60.0 to 0.64.1 (0.65.0 is outside it) - CVE-2026-116773: 0.34.0-beta.1 to 0.64.1 (0.65.0 is outside it) - CVE-2026-116696: 0.34.0-beta.1 to 0.64.1 (0.65.0 is outside it) - CVE-2026-111061: 0.34.0-beta.1 to 0.64.0 (0.64.1 is outside it) - CVE-2026-102825: 0.34.0-beta.1 to 0.62.5 (0.62.6 is outside it) - CVE-2026-102824: 0.34.0-beta.1 to 0.63.0-beta.1 (0.63.0 is outside it) - CVE-2026-102823: 0.34.0-beta.1 to 0.63.0 (0.63.1 is outside it) - CVE-2026-102822: 0.34.0-beta.1 to 0.63.0 (0.63.1 is outside it) - CVE-2026-102821: 0.34.0-beta.1 to 0.63.1 (0.63.2 is outside it) - CVE-2026-73489: 0.34.0-beta.1 to 0.62.3 (0.62.4 is outside it) - CVE-2026-73430: 0.34.0-beta.1 to 0.62.3 (0.62.4 is outside it) - CVE-2026-73429: 0.34.0-beta.1 to 0.62.3 (0.62.4 is outside it) - CVE-2026-68930: 0.34.0-beta.1 to 0.62.4 (0.62.5 is outside it) - CVE-2026-48110: 0.34.0 to 0.60.3 (0.61.0 is outside it) - CVE-2026-48108: 0.34.0-beta.1 to 0.60.3 (0.61.0 is outside it) - CVE-2026-48107: 0.37.1 to 0.60.3 (0.61.0 is outside it) - CVE-2026-46705: 0.34.0-beta.1 to 0.60.3 (0.61.0 is outside it) - CVE-2026-46702: 0.34.0 to 0.61.0 (0.61.1 is outside it) - CVE-2026-46673: 0.34.0-beta.1 to 0.60.2 (0.60.3 is outside it) - CVE-2026-42189: 0.34.0-beta.1 to 0.60.0 (0.60.1 is outside it) - CVE-2025-54804: 0.34.0-beta.1 to 0.54.0 (0.54.1 is outside it) - CVE-2024-43410: 0.34.0-beta.1 to 0.44.0 (0.44.1 is outside it) - CVE-2023-48795: 0.34.0-beta.1 to 0.40.1 (0.40.2 is outside it) - CVE-2023-28113: 0.34.0-beta.1 to 0.36.1 (0.36.2 is outside it) ## Advisories (25) ### [CVE-2026-116794](https://cve.now/CVE-2026-116794): russh: Agent server never calls \`Agent::confirm\`, so keys added with the confirm constraint (\`ssh-add -c\`) sign without confirmation - Severity: High 8.3 - Published: Oct 28, 2026 - Affected: fixed in 0.65. - Fixed in 0.65.0 (released Oct 25, 2026, 3 days before disclosure). - The latest release, 0.65.1, is not affected. - 95% of russh downloads in the last 90 days were affected versions (4.2M). ### [CVE-2026-116774](https://cve.now/CVE-2026-116774): russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) - Severity: Medium 4.3 - Published: Oct 27, 2026 - Affected: from 0.60.0, fixed in 0.65. - Fixed in 0.65.0 (released Oct 25, 2026, 2 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-116773](https://cve.now/CVE-2026-116773): russh's SSH client is susceptible to unbounded allocations via EXT\_INFO packets - Severity: Medium 4.3 - Published: Oct 27, 2026 - Affected: fixed in 0.65. - Fixed in 0.65.0 (released Oct 25, 2026, 2 days before disclosure). - The latest release, 0.65.1, is not affected. - 95% of russh downloads in the last 90 days were affected versions (4.2M). ### [CVE-2026-116696](https://cve.now/CVE-2026-116696): russh's SSH agent server is susceptible to unbound allocations via repeated SSH\_AGENT\_CONSTRAIN\_CONFIRM messages - Severity: Low 3.3 - Published: Oct 27, 2026 - Affected: fixed in 0.65.0. - Fixed in 0.65.0 (released Oct 25, 2026, 2 days before disclosure). - The latest release, 0.65.1, is not affected. - 95% of russh downloads in the last 90 days were affected versions (4.2M). ### [CVE-2026-111061](https://cve.now/CVE-2026-111061): russh agent server converts constraint records into unbounded never-rolled-back tasks - Severity: Medium 4.3 - Published: Oct 19, 2026 - Affected: fixed in 0.64.1. - Fixed in 0.64.1 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 0.65.1, is not affected. - 81% of russh downloads in the last 90 days were affected versions (3.6M). ### [CVE-2026-102825](https://cve.now/CVE-2026-102825): Russh: Configured server auth-attempt cap is not enforced in the USERAUTH\_REQUEST runtime path - Severity: Low 3.7 - Published: Sep 29, 2026 - Affected: fixed in 0.62.6. - Fixed in 0.62.6 (released Aug 11, 2026, 49 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-102824](https://cve.now/CVE-2026-102824): Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange - Severity: Medium 4.3 - Published: Sep 29, 2026 - Affected: fixed in 0.63.0. - Fixed in 0.63.0 (released Aug 21, 2026, 39 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-102823](https://cve.now/CVE-2026-102823): russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened - Severity: High 7.5 - Published: Sep 29, 2026 - Affected: fixed in 0.63.1. - Fixed in 0.63.1 (released Aug 23, 2026, 37 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-102822](https://cve.now/CVE-2026-102822): russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic - Severity: Low 3.7 - Published: Sep 29, 2026 - Affected: fixed in 0.63.1. - Fixed in 0.63.1 (released Aug 23, 2026, 37 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-102821](https://cve.now/CVE-2026-102821): Russh: Unbounded memory exhaustion via CHANNEL\_OPEN flood during a client-stalled rekey - Severity: Medium 6.5 - Published: Sep 29, 2026 - Affected: fixed in 0.63.2. - Fixed in 0.63.2 (released Sep 3, 2026, 26 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-73489](https://cve.now/CVE-2026-73489): Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records - Severity: Medium 4.3 - Published: Aug 13, 2026 - Affected: fixed in 0.62.4. - Fixed in 0.62.4 (released Jul 22, 2026, 22 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-73430](https://cve.now/CVE-2026-73430): Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode\_mpint OOB) - Severity: Medium 5.3 - Published: Aug 12, 2026 - Affected: fixed in 0.62.4. - Fixed in 0.62.4 (released Jul 22, 2026, 21 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-73429](https://cve.now/CVE-2026-73429): Russh: client wrong-length X25519 \`clone\_from\_slice\` panic (pre-auth DoS) - Severity: Medium 5.3 - Published: Aug 12, 2026 - Affected: fixed in 0.62.4. - Fixed in 0.62.4 (released Jul 22, 2026, 21 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-68930](https://cve.now/CVE-2026-68930): Russh: Channel-scoped server callbacks can be reached without an open channel - Severity: Medium 6.5 - Published: Aug 3, 2026 - Affected: fixed in 0.62.5. - Fixed in 0.62.5 (released Jul 31, 2026, 3 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-48110](https://cve.now/CVE-2026-48110): Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds - Severity: High 7.5 - Published: Jun 10, 2026 - Affected: from 0.34.0, fixed in 0.61.0. - Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-48108](https://cve.now/CVE-2026-48108): Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input - Severity: Medium 5.3 - Published: Jun 10, 2026 - Affected: from 0.34.0-beta.1, fixed in 0.61.0. - Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-48107](https://cve.now/CVE-2026-48107): Russh: Unchecked keyboard-interactive prompt count in client auth path - Severity: Medium 6.5 - Published: Jun 10, 2026 - Affected: from 0.37.0, fixed in 0.61.0. - Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-46705](https://cve.now/CVE-2026-46705): russh server userauth state is not reset when authentication principal changes - Severity: Medium 5.3 - Published: Jun 10, 2026 - Affected: from 0.34.0-beta.1, fixed in 0.61.0. - Fixed in 0.61.0 (released May 20, 2026, 21 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-46702](https://cve.now/CVE-2026-46702): Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets - Severity: High 7.5 - Published: Jun 10, 2026 - Affected: from 0.34.0, fixed in 0.61.1. - Fixed in 0.61.1 (released May 23, 2026, 18 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-46673](https://cve.now/CVE-2026-46673): Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote… - Severity: High 7.5 - Published: Jun 10, 2026 - Affected: fixed in 0.60.3; fixed in 0.60.3. - Fixed in 0.60.3 (released May 15, 2026, 26 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2026-42189](https://cve.now/CVE-2026-42189): Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth - Severity: High 7.5 - Published: May 8, 2026 - Affected: fixed in 0.60.1. - Fixed in 0.60.1 (released Apr 20, 2026, 18 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2025-54804](https://cve.now/CVE-2025-54804): Russh is missing an overflow check during channel windows adjust - Severity: Medium 6.5 - Published: Aug 5, 2025 - Affected: fixed in 0.54.1. - Fixed in 0.54.1 (released Aug 4, 2025, 1 day before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2024-43410](https://cve.now/CVE-2024-43410): Russh has an OOM Denial of Service due to allocation of untrusted amount - Severity: High 7.5 - Published: Aug 21, 2024 - Affected: fixed in 0.44.1. - Fixed in 0.44.1 (released Aug 14, 2024, 7 days before disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2023-48795](https://cve.now/CVE-2023-48795): The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas - Severity: Medium 5.9 - Published: Dec 18, 2023 - Affected: fixed in 0.40.2. - Fixed in 0.40.2 (released Dec 18, 2023, the day of disclosure). - The latest release, 0.65.1, is not affected. ### [CVE-2023-28113](https://cve.now/CVE-2023-28113): russh may use insecure Diffie-Hellman keys - Severity: Medium 5.9 - Published: Mar 16, 2023 - Affected: fixed in 0.36.2; from 0.37.0, fixed in 0.37.1. - Fixed in 0.36.2 (released Mar 16, 2023, the day of disclosure) and 0.37.1 (released Mar 16, 2023, the day of disclosure). - The latest release, 0.65.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/russh Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.