Is CVE-2026-48107 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48107 being exploited in the wild.

How severe is CVE-2026-48107?

Medium severity, with a CVSS score of 6.5, published 10 June 2026.

Which products and versions are affected?

russh (crates.io) SEMVER:introduced=0.37.0,fixed=0.61.0.

Is there a fix for CVE-2026-48107?

Yes. russh (crates.io): upgrade to 0.61.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48107 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48107?

Check whether you run russh (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48107: Russh denial of service via unchecked prompt count in client auth path

CVE-2026-48107 · Severity: medium · CVSS 6.5 · Published 2026-06-10

Russh is a Rust library used to implement SSH clients and servers. A vulnerability in the client-side authentication process allows a malicious SSH server to crash or exhaust the resources of a connecting client. This occurs when the server sends a specially crafted request that forces the client to attempt an impossibly large memory allocation, leading to a denial-of-service.

Technologies: russh (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-48107 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48107 being exploited in the wild.
How severe is CVE-2026-48107?: Medium severity, with a CVSS score of 6.5, published 10 June 2026.
Which products and versions are affected?: russh (crates.io) SEMVER:introduced=0.37.0,fixed=0.61.0.
Is there a fix for CVE-2026-48107?: Yes. russh (crates.io): upgrade to 0.61.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48107 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48107?: Check whether you run russh (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

russh (crates.io): upgrade to 0.61.0 or later
```
cargo update -p russh
```

Technical details

A vulnerability exists in the `russh` client's handling of `SSH_MSG_USERAUTH_INFO_REQUEST` packets during keyboard-interactive authentication. The client parses the `n_prompts` field and uses it directly in `Vec::with_capacity()` without verifying if the packet actually contains the corresponding amount of data. A malicious server can provide a large `u32` value for `n_prompts` in a small packet, causing the client to attempt a massive memory allocation (e.g., ~128GB), resulting in a crash or resource exhaustion. This is fixed in version 0.61.0 by validating that the declared prompt count is consistent with the remaining packet length.

Affected products

Eugeny russh >= 0.37.0, < 0.61.0

Identifiers

CVE-2026-48107
GHSA-g9g7-5cgw-6v28

Timeline

2026-05-20: disclosed
2026-06-10: advisory: NVD publication
2026-06-11: patched: GitHub Advisory published/updated with patch version 0.61.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.