CVE-2026-42189: Russh SSH library denial of service in keyboard-interactive auth

Executive brief

A denial-of-service vulnerability exists in russh, a library used to implement SSH servers in Rust. An unauthenticated attacker can crash the server by sending a single specially crafted packet during the login process, specifically when multi-factor authentication (like 2FA or TOTP) is enabled. This results in a complete service outage for all users and can be repeated to prevent the server from restarting.

Technical details

A memory allocation vulnerability (CWE-770/CWE-789) exists in `russh/src/server/encrypted.rs` within the `read_userauth_info_response` function. The handler decodes a `u32` integer from a client's `SSH_MSG_USERAUTH_INFO_RESPONSE` packet and uses it directly in `Vec::with_capacity()` without validating it against the actual remaining packet size. An unauthenticated attacker can provide a large value (e.g., 0x10000000), forcing the server to attempt a multi-gigabyte allocation that triggers an Out-of-Memory (OOM) crash. This occurs during the keyboard-interactive authentication flow before any credentials are validated. The issue is fixed in version 0.60.1 by capping the allocation capacity based on the remaining packet data.

Affected products

• Eugeny russh < 0.60.1

Timeline

• 2026-04-20: disclosed
• 2026-04-24: advisory
• 2026-04-24: patched: Fixed in version 0.60.1

References

• https://api.github.com/users/coreyleavitt
• https://github.com/coreyleavitt
• https://api.github.com/users/coreyleavitt/gists%7B/gist_id%7D
• https://api.github.com/users/coreyleavitt/repos
• https://avatars.githubusercontent.com/u/18317330?v=4
• https://api.github.com/users/coreyleavitt/events%7B/privacy%7D