CVE-2026-42189

The record

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.

Affected packages

Related vulnerabilities

• GHSA-f5v4-2wr6-hqmg russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler Same vulnerability
• GHSA-4r3c-5hpg-58qr Russh SSH message fields were decoded through allocation-first parsers before… Also affects russh
• GHSA-76r6-x97p-67vr Russh: SSH identification parsing accepted non-canonical client banners and did not bound… Also affects russh
• GHSA-g9g7-5cgw-6v28 Russh: Unchecked keyboard-interactive prompt count in client auth path Also affects russh
• CVE-2026-48108 Russh is a Rust SSH client & server library. Also affects russh
• CVE-2026-48110 Russh is a Rust SSH client & server library. Also affects russh
• CVE-2026-46702 Russh is a Rust SSH client & server library. Also affects russh
• CVE-2026-46705 Russh is a Rust SSH client & server library. Also affects russh