CVE-2026-42189: falha de alta gravidade em Eugeny russh
Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Eugeny · russhCVEs relacionadas — Eugeny russh
No mesmo produto, das mais perigosas para as menos.
CVE-2024-43410HIGHRussh has an OOM Denial of Service due to allocation of untrusted amountEPSS 0.9%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.6%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.5%CVE-2026-73489MEDIUMRussh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsEPSS 0.5%CVE-2025-54804MEDIUMRussh is missing an overflow check during channel windows adjustEPSS 0.4%CVE-2026-68930MEDIUMRussh: Channel-scoped server callbacks can be reached without an open channelEPSS 0.4%