Medium severity · published Jun 10, 2026
CVE-2026-48107
Russh: Unchecked keyboard-interactive prompt count in client auth path
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTH_INFO_REQUEST with an attacker-controlled prompt count, and the client would use that raw count directly in Vec::with_capacity(...) before validating that enough prompt data was actually present in the packet. This issue has been patched in version 0.61.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
russh · Eugeny
>= 0.37.0, < 0.61.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48107
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48107
github.com
https://github.com/Eugeny/russh/security/advisories/GHSA-g9g7-5cgw-6v28
More from russh
8.3
CVE-2026-116794
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
7.5
CVE-2026-102823
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
7.5
CVE-2026-48110
Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds
7.5
CVE-2026-46702
Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
7.5
CVE-2026-46673
Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases