Skip to content
Eugeny vulnerabilities
Newest
-
eugeny russh
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
CVE-2026-116794
Fix available
8.3 High
-
eugeny russh
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
CVE-2026-116775
Fix available
2.3 Low
-
eugeny russh
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
CVE-2026-116774
Fix available
4.3 Medium
-
eugeny russh
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
CVE-2026-116773
Fix available
4.3 Medium
-
eugeny russh
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
CVE-2026-116696
Fix available
3.3 Low
-
eugeny russh
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
CVE-2026-111062
Fix available
2.3 Low
-
eugeny russh
russh agent server converts constraint records into unbounded never-rolled-back tasks
CVE-2026-111061
Fix available
4.3 Medium
-
eugeny russh
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
CVE-2026-102825
Fix available
3.7 Low
-
eugeny russh
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
CVE-2026-102824
Fix available
4.3 Medium
-
eugeny russh
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
CVE-2026-102823
Fix available
7.5 High
-
eugeny russh
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
CVE-2026-102822
Fix available
3.7 Low
-
eugeny russh
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
CVE-2026-102821
Fix available
6.5 Medium
-
eugeny russh, rust pageant +1 more
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
CVE-2026-102820
Fix available
6.2 Medium
-
eugeny tabby
Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
CVE-2026-72903
8.1 High
-
eugeny russh
Russh: Channel-scoped server callbacks can be reached without an open channel
CVE-2026-68930
Fix available
6.5 Medium
-
eugeny russh
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
CVE-2026-73429
Fix available
5.3 Medium
-
eugeny russh
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
CVE-2026-73489
Fix available
4.3 Medium
-
eugeny russh
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
CVE-2026-73430
Fix available
5.3 Medium
-
eugeny tabby
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
CVE-2026-46709
7.8 High
-
eugeny russh
Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds
CVE-2026-48110
Fix available
7.5 High
-
eugeny russh
Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
CVE-2026-48108
Fix available
5.3 Medium
-
eugeny russh
Russh: Unchecked keyboard-interactive prompt count in client auth path
CVE-2026-48107
Fix available
6.5 Medium
-
eugeny russh
russh server userauth state is not reset when authentication principal changes
CVE-2026-46705
Fix available
5.3 Medium
-
eugeny russh
Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
CVE-2026-46702
Fix available
7.5 High
-
eugeny tabby
Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution
CVE-2026-45038
8.4 High
-
eugeny tabby
Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh
CVE-2026-45036
7.0 High
-
eugeny tabby
Tabby: RCE via `tabby://run` URL Scheme
CVE-2026-45035
9.4 Critical
-
eugeny tabby
Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
CVE-2026-45037
7.1 High
-
eugeny russh
Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases
CVE-2026-46673
Fix available
7.5 High
-
eugeny russh, warpgate project warpgate +1 more
Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth
CVE-2026-42189
Fix available
7.5 High
-
eugeny russh, warpgate project warpgate +1 more
Russh is missing an overflow check during channel windows adjust
CVE-2025-54804
Fix available
6.5 Medium
-
eugeny tabby
Tabby has a TCC Bypass via Misconfigured Node Fuses
CVE-2025-22136
8.6 High
-
eugeny tabby
Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby
CVE-2024-55950
8.6 High
-
eugeny russh, warpgate project warpgate +1 more
Russh has an OOM Denial of Service due to allocation of untrusted amount
CVE-2024-43410
Fix available
7.5 High
-
eugeny russh
russh may use insecure Diffie-Hellman keys
CVE-2023-28113
Fix available
5.9 Medium