Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-48107Russh: Unchecked keyboard-interactive prompt count in client auth path

Medium 6.5

In plain English

A medium-severity improper input validation in russh from Eugeny. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTH_INFO_REQUEST with an attacker-controlled prompt count, and the client would use that raw count directly in Vec::with_capacity(...) before validating that enough prompt data was actually present in the packet. This issue has been patched in version 0.61.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	rust-russh	0.64.1-1	DEBIAN-CVE-2026-48107

Affected products (as reported)

Vendor	Product	Versions
Eugeny	russh	>= 0.37.0, < 0.61.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/Eugeny/russh/security/advisories/GHSA-g9g7-5cgw-6v28 x_refsource_CONFIRM