Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M

CVE-2026-102825Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Low 3.7

In plain English

A low-severity security flaw in russh from Eugeny. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.4%top 70.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	rust-russh	0.64.1-1	DEBIAN-CVE-2026-102825
Ubuntu:26.10	rust-russh	no fix listed	UBUNTU-CVE-2026-102825

Affected products (as reported)

Vendor	Product	Versions
Eugeny	russh	< 0.62.6

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35 x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653 x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.62.6 x_refsource_MISC