RU
Product
russh
22
CVEs
0
On KEV
7.5
Max CVSS
11
New 30D
Severity mix
Critical 0High 5Medium 13Low 4
Watch
Add russh to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102823 | 7.5 | Sep 29 | russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened Affected: < 0.63.1 |
| CVE-2026-48110 | 7.5 | Jun 10 | Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds Affected: >= 0.34.0, < 0.61.0 |
| CVE-2026-46702 | 7.5 | Jun 10 | Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets Affected: >= 0.34.0, < 0.61.1 |
| CVE-2026-46673 | 7.5 | Jun 10 | Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases Affected: < 0.60.3 |
| CVE-2026-42189 | 7.5 | May 8 | Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth Affected: < 0.60.1 |
Showing 5