# CVE-2026-48107: Russh denial of service via unchecked prompt count in client auth path

Source: https://junglewise.ai/threats/cve-2026-48107-russh-denial-of-service-via-unchecked-prompt-count-in-client-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-48107 · Severity: medium · CVSS 6.5 · Published 2026-06-10

Russh is a Rust library used to implement SSH clients and servers. A vulnerability in the client-side authentication process allows a malicious SSH server to crash or exhaust the resources of a connecting client. This occurs when the server sends a specially crafted request that forces the client to attempt an impossibly large memory allocation, leading to a denial-of-service.

Technologies: [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-48107 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48107 being exploited in the wild.

**How severe is CVE-2026-48107?** Medium severity, with a CVSS score of 6.5, published 10 June 2026.

**Which products and versions are affected?** russh (crates.io) SEMVER:introduced=0.37.0,fixed=0.61.0.

**Is there a fix for CVE-2026-48107?** Yes. russh (crates.io): upgrade to 0.61.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48107 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48107?** Check whether you run russh (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- russh (crates.io): upgrade to 0.61.0 or later

  ```sh
  cargo update -p russh
  ```


## Technical details

A vulnerability exists in the `russh` client's handling of `SSH_MSG_USERAUTH_INFO_REQUEST` packets during keyboard-interactive authentication. The client parses the `n_prompts` field and uses it directly in `Vec::with_capacity()` without verifying if the packet actually contains the corresponding amount of data. A malicious server can provide a large `u32` value for `n_prompts` in a small packet, causing the client to attempt a massive memory allocation (e.g., ~128GB), resulting in a crash or resource exhaustion. This is fixed in version 0.61.0 by validating that the declared prompt count is consistent with the remaining packet length.

## Affected products

- Eugeny russh >= 0.37.0, < 0.61.0

## Identifiers

- CVE-2026-48107
- GHSA-g9g7-5cgw-6v28

## Timeline

- 2026-05-20: disclosed
- 2026-06-10: advisory: NVD publication
- 2026-06-11: patched: GitHub Advisory published/updated with patch version 0.61.0

## References

- [https://api.github.com/users/mjc](https://api.github.com/users/mjc)
- [https://github.com/mjc](https://github.com/mjc)
- [https://api.github.com/users/mjc/gists%7B/gist_id%7D](https://api.github.com/users/mjc/gists%7B/gist_id%7D)
- [https://api.github.com/users/mjc/repos](https://api.github.com/users/mjc/repos)
- [https://avatars.githubusercontent.com/u/1977?v=4](https://avatars.githubusercontent.com/u/1977?v=4)
- [https://api.github.com/users/mjc/events%7B/privacy%7D](https://api.github.com/users/mjc/events%7B/privacy%7D)

## Related threats

- [russh SSH server signature algorithm mismatch in publickey auth](https://junglewise.ai/threats/cve-2026-111062-a-russh-ssh-server-accepts-a-publickey-authentication-whose)
- [russh SSH agent confirmation bypass](https://junglewise.ai/threats/cve-2026-116794-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh SSH library zero maximum packet size denial of service](https://junglewise.ai/threats/cve-2026-116774-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh memory exhaustion via unbounded EXT_INFO packets](https://junglewise.ai/threats/cve-2026-116773-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages](https://junglewise.ai/threats/cve-2026-116696-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)