russh vulnerabilities (crates.io)
26 vulnerabilities.
-
russhcrates.io russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation 8.3 High -
russhcrates.io russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) 4.3 Medium -
russhcrates.io russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets 4.3 Medium -
russhcrates.io russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages 3.3 Low -
russhcrates.io A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request 2.3 Low -
russhcrates.io russh agent server converts constraint records into unbounded never-rolled-back tasks 4.3 Medium -
russhcrates.io Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path 3.7 Low -
russhcrates.io Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange 4.3 Medium -
russhcrates.io russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened 7.5 High -
russhcrates.io russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic 3.7 Low -
russhcrates.io Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey 6.5 Medium -
russhcrates.io Russh: Channel-scoped server callbacks can be reached without an open channel 6.5 Medium -
russhcrates.io Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) 5.3 Medium -
russhcrates.io Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records 4.3 Medium -
russhcrates.io Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB) 5.3 Medium -
russhcrates.io Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds 7.5 High -
russhcrates.io Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input 5.3 Medium -
russhcrates.io Russh: Unchecked keyboard-interactive prompt count in client auth path 6.5 Medium -
russhcrates.io russh server userauth state is not reset when authentication principal changes 5.3 Medium -
russhcrates.io Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets 7.5 High -
russhcrates.io Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases 7.5 High -
russhcrates.io Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth 7.5 High -
russhcrates.io Russh is missing an overflow check during channel windows adjust 6.5 Medium -
russhcrates.io Russh has an OOM Denial of Service due to allocation of untrusted amount 7.5 High -
russhcrates.io Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin 5.9 Medium -
russhcrates.io russh may use insecure Diffie-Hellman keys 5.9 Medium