Vulnerability in russh (CVE-2026-102825)
Summary
Vulnerability in russh (CVE-2026-102825). Risk of unauthorized operations or information disclosure. Exploitable via main. Mitigation: upgrade to 0.62.6 or later.
Original description
The description as published by the source.
Details
Affected versions and vulnerable location
- Confirmed present on default branch
mainat HEAD0089c89c94753bebbec12b956c07a1cd38740379. - Crate version at HEAD:
0.62.4. - Vulnerable locations on current default branch:
russh/src/server/mod.rs:91(pub max_auth_attempts: usize)russh/src/server/mod.rs:121(defaultmax_auth_attempts: 10)russh/src/server/encrypted.rs:89(USERAUTH_REQUESTdispatch into auth handler path)russh/src/server/encrypted.rs:98(self.common.auth_attempts += 1)russh/src/server/encrypted.rs:53(only runtime read ofauth_attempts, used for initial reject timing, not attempt limiting)
- Default-branch history check did not show a newer merged commit adding enforcement against
config.max_auth_attempts.
Reachability trace verified
- Entry point: exported server API
server::run_streaminrussh/src/server/mod.rs:1049. - Session run loop in
russh/src/server/session.rsprocesses incoming packets and callsreply(...)(server/session.rs:725). replyforwards encrypted packets tosession.server_read_encrypted(...)(server/mod.rs:1221).server_read_encryptedroutesUSERAUTH_REQUESTtoenc.server_read_auth_request(...)(server/encrypted.rs:89).- On each request,
self.common.auth_attempts += 1executes (server/encrypted.rs:98). - No comparison against
self.common.config.max_auth_attemptsis present in this runtime flow.
PoC
Reproduction steps and…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-102825 has been found in russh.
Attackers can target a specific entry point like main over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 3.7/10.
What to do: upgrade russh to 0.62.6 or later.
If unsure, ask your IT team or search "russh CVE-2026-102825" on the vendor's site.
CVE-2026-102825 (russh) — CWE-307 / CVSS v3 3.7
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: main / USERAUTH_REQUEST / auth_attempts / config.max_auth_attempts
Patched: 0.62.6 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-307) exists in russh. Attackers reach the vulnerable code path via main without authentication.
Check the vendor advisory for the affected versions of russh. Attack surface: main / USERAUTH_REQUEST / auth_attempts / config.max_auth_attempts.
Severity: Low (CVSS 3.7/10). Risk of unauthorized operations or information disclosure.
Update to 0.62.6.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'russh' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'russh' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
russhを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade russh to 0.62.6ステージング環境で 0.62.6 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com
- web nvd.nist.gov
- web github.com