RU
Product
russh
25
CVEs
0
On KEV
8.3
Max CVSS
12
New 30D
Severity mix
Critical 0High 7Medium 14Low 4
Watch
Add russh to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116794 New | 8.3 | Oct 28 | russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation Affected: < 0.65 |
| CVE-2026-102823 | 7.5 | Sep 29 | russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened Affected: < 0.63.1 |
| CVE-2026-48110 | 7.5 | Jun 10 | Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds Affected: >= 0.34.0, < 0.61.0 |
| CVE-2026-46702 | 7.5 | Jun 10 | Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets Affected: >= 0.34.0, < 0.61.1 |
| CVE-2026-46673 | 7.5 | Jun 10 | Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases Affected: < 0.60.3 |
| CVE-2026-42189 | 7.5 | May 8 | Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth Affected: < 0.60.1 |
| CVE-2024-43410 | 7.5 | Aug 21 | Russh has an OOM Denial of Service due to allocation of untrusted amount Affected: < 0.44.1 |
Showing 7