Is CVE-2026-102823 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102823 being exploited in the wild.

How severe is CVE-2026-102823?

High severity, with a CVSS score of 7.5, published 29 September 2026.

Which products and versions are affected?

russh (crates.io) <= 0.63.0, SEMVER:introduced=0,fixed=0.63.1; Russh before 0.63.1.

Is there a fix for CVE-2026-102823?

Yes. russh (crates.io): upgrade to 0.63.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102823 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102823?

Check whether you run russh (crates.io) or Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102823: Russh SSH library channel ID validation bypass

Q: Which products and versions are affected?

russh (crates.io) <= 0.63.0, SEMVER:introduced=0,fixed=0.63.1; Russh before 0.63.1.

Q: Is there a fix for CVE-2026-102823?

Yes. russh (crates.io): upgrade to 0.63.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102823 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102823?

Check whether you run russh (crates.io) or Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102823 · Severity: high · CVSS 7.5 · Published 2026-09-29

Russh is a Rust library for building SSH clients and servers. Prior to version 0.63.1, a malicious SSH server can send lifecycle events (like exit status or channel close) referencing channel identifiers that were never opened or already closed. This causes the client application to panic or corruption of command completion tracking, potentially leading to denial of service or incorrect command handling.

Technologies: russh (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-102823 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102823 being exploited in the wild.
How severe is CVE-2026-102823?: High severity, with a CVSS score of 7.5, published 29 September 2026.
Which products and versions are affected?: russh (crates.io) <= 0.63.0, SEMVER:introduced=0,fixed=0.63.1; Russh before 0.63.1.
Is there a fix for CVE-2026-102823?: Yes. russh (crates.io): upgrade to 0.63.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102823 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102823?: Check whether you run russh (crates.io) or Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

russh (crates.io): upgrade to 0.63.1 or later
```
cargo update -p russh
```

Technical details

The vulnerability exists in client_read_authenticated() in russh/src/client/encrypted.rs, which forwards SSH protocol messages (CHANNEL_DATA, CHANNEL_EOF, CHANNEL_CLOSE, etc.) to public Handler callbacks without validating that the referenced ChannelId belongs to an established channel opened by the client. A malicious server can exploit this by sending messages with predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or state corruption. The fix adds is_established_channel() validation before processing channel events.

Affected products

Russh before 0.63.1

Identifiers

CVE-2026-102823
GHSA-47hw-gvq5-r2gm

Timeline

2026-09-29: disclosed
2026-08-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.