Skip to contentEugeny Russh vulnerabilities
- eugeny russhrussh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116794Fix available8.3 High
- eugeny russhpageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)CVE-2026-116775Fix available2.3 Low
- eugeny russhrussh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)CVE-2026-116774Fix available4.3 Medium
- eugeny russhrussh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsCVE-2026-116773Fix available4.3 Medium
- eugeny russhrussh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesCVE-2026-116696Fix available3.3 Low
- eugeny russhA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestCVE-2026-111062Fix available2.3 Low
- eugeny russhrussh agent server converts constraint records into unbounded never-rolled-back tasksCVE-2026-111061Fix available4.3 Medium
- eugeny russhRussh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathCVE-2026-102825Fix available3.7 Low
- eugeny russhRussh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeCVE-2026-102824Fix available4.3 Medium
- eugeny russhrussh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedCVE-2026-102823Fix available7.5 High
- eugeny russhrussh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicCVE-2026-102822Fix available3.7 Low
- eugeny russhRussh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyCVE-2026-102821Fix available6.5 Medium
- eugeny russh, rust pageant +1 morepageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)CVE-2026-102820Fix available6.2 Medium
- eugeny russhRussh: Channel-scoped server callbacks can be reached without an open channelCVE-2026-68930Fix available6.5 Medium
- eugeny russhRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)CVE-2026-73429Fix available5.3 Medium
- eugeny russhRussh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsCVE-2026-73489Fix available4.3 Medium
- eugeny russhRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)CVE-2026-73430Fix available5.3 Medium
- eugeny russhRussh: SSH message fields were decoded through allocation-first parsers before field-specific boundsCVE-2026-48110Fix available7.5 High
- eugeny russhRussh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner inputCVE-2026-48108Fix available5.3 Medium
- eugeny russhRussh: Unchecked keyboard-interactive prompt count in client auth pathCVE-2026-48107Fix available6.5 Medium
- eugeny russhrussh server userauth state is not reset when authentication principal changesCVE-2026-46705Fix available5.3 Medium
- eugeny russhRussh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetsCVE-2026-46702Fix available7.5 High
- eugeny russhRussh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releasesCVE-2026-46673Fix available7.5 High
- eugeny russh, warpgate project warpgate +1 moreRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive authCVE-2026-42189Fix available7.5 High
- eugeny russh, warpgate project warpgate +1 moreRussh is missing an overflow check during channel windows adjustCVE-2025-54804Fix available6.5 Medium
- eugeny russh, warpgate project warpgate +1 moreRussh has an OOM Denial of Service due to allocation of untrusted amountCVE-2024-43410Fix available7.5 High
- eugeny russhrussh may use insecure Diffie-Hellman keysCVE-2023-28113Fix available5.9 Medium