Vulnerabilities in Eugeny
34 resultsCVE-2024-43410HIGHRussh has an OOM Denial of Service due to allocation of untrusted amountEPSS 0.9%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.6%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.5%CVE-2026-72903HIGHTabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directoryEPSS 0.5%CVE-2026-42189HIGHRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive authEPSS 0.5%CVE-2026-73489MEDIUMRussh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsEPSS 0.5%CVE-2025-54804MEDIUMRussh is missing an overflow check during channel windows adjustEPSS 0.4%CVE-2026-45035CRITICALTabby: RCE via `tabby://run` URL SchemeEPSS 0.4%CVE-2026-68930MEDIUMRussh: Channel-scoped server callbacks can be reached without an open channelEPSS 0.4%CVE-2026-48110HIGHRussh: SSH message fields were decoded through allocation-first parsers before field-specific boundsEPSS 0.4%CVE-2025-22136HIGHTabby has a TCC Bypass via Misconfigured Node FusesEPSS 0.4%CVE-2026-102821MEDIUMRussh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyEPSS 0.4%CVE-2026-111062LOWA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestEPSS 0.4%CVE-2026-102825LOWRussh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathEPSS 0.4%CVE-2026-111061MEDIUMrussh agent server converts constraint records into unbounded never-rolled-back tasksEPSS 0.3%CVE-2026-102822LOWrussh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicEPSS 0.3%CVE-2026-102823HIGHrussh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedEPSS 0.3%CVE-2024-55950HIGHTabby has a TCC Bypass via Unnecessary Permissive Entitlements in TabbyEPSS 0.3%CVE-2026-116775LOWpageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)EPSS 0.3%CVE-2026-48108MEDIUMRussh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner inputEPSS 0.3%