Junglewise Threat Intelligence

CVE-2026-48107: Russh denial of service via unchecked prompt count in client auth path

CVE-2026-48107 · Severity: medium · CVSS 6.5 · Published 2026-06-10

Technologies: russh (crates.io). Vendors: Eugeny, crates.io.

Executive brief

Russh is a Rust library used to implement SSH clients and servers. A vulnerability in the client-side authentication process allows a malicious SSH server to crash or exhaust the resources of a connecting client. This occurs when the server sends a specially crafted request that forces the client to attempt an impossibly large memory allocation, leading to a denial-of-service.

Technical details

A vulnerability exists in the `russh` client's handling of `SSH_MSG_USERAUTH_INFO_REQUEST` packets during keyboard-interactive authentication. The client parses the `n_prompts` field and uses it directly in `Vec::with_capacity()` without verifying if the packet actually contains the corresponding amount of data. A malicious server can provide a large `u32` value for `n_prompts` in a small packet, causing the client to attempt a massive memory allocation (e.g., ~128GB), resulting in a crash or resource exhaustion. This is fixed in version 0.61.0 by validating that the declared prompt count is consistent with the remaining packet length.

Affected products

  • Eugeny russh >= 0.37.0, < 0.61.0

Timeline

  • 2026-05-20: disclosed
  • 2026-06-10: advisory: NVD publication
  • 2026-06-11: patched: GitHub Advisory published/updated with patch version 0.61.0

References

Related threats