# russh (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/crates-io-russh Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/crates-io-russh.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in russh (crates.io): 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111062, was published on 5 November 2026. 6 vulnerabilities in the last four weeks, up 20% on the four before (5). ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 11 - All time: 26 (0 critical, 0 exploited in the wild) ## About russh (crates.io) Rust library implementing SSH protocol functionality for secure remote command execution. ## Latest russh (crates.io) vulnerabilities - [CVE-2026-111062: russh SSH server signature algorithm mismatch in publickey auth](https://junglewise.ai/threats/cve-2026-111062-a-russh-ssh-server-accepts-a-publickey-authentication-whose) (medium, CVSS 4, published 5 Nov 2026) - [CVE-2026-116794: russh SSH agent confirmation bypass](https://junglewise.ai/threats/cve-2026-116794-russh-is-a-rust-ssh-client-and-server-library-that-includes-an) (high, CVSS 4, published 28 Oct 2026) - [CVE-2026-116774: russh SSH library zero maximum packet size denial of service](https://junglewise.ai/threats/cve-2026-116774-russh-is-a-rust-ssh-client-and-server-library-that-includes-an) (medium, CVSS 4.3, published 27 Oct 2026) - [CVE-2026-116773: russh memory exhaustion via unbounded EXT_INFO packets](https://junglewise.ai/threats/cve-2026-116773-russh-is-a-rust-ssh-client-and-server-library-that-includes-an) (medium, CVSS 4.3, published 27 Oct 2026) - [CVE-2026-116696: russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages](https://junglewise.ai/threats/cve-2026-116696-russh-is-a-rust-ssh-client-and-server-library-that-includes-an) (low, CVSS 3.3, published 27 Oct 2026) - [CVE-2026-111061: russh SSH agent unbounded memory allocation via constraint records](https://junglewise.ai/threats/cve-2026-111061-russh-is-a-rust-ssh-client-and-server-library-that-includes-an) (medium, CVSS 4.3, published 19 Oct 2026) - [CVE-2026-102825: Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path](https://junglewise.ai/threats/cve-2026-102825-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-62-6) (low, CVSS 3.7, published 29 Sep 2026) - [CVE-2026-102824: Russh hybrid ML-KEM key exchange validation bypass](https://junglewise.ai/threats/cve-2026-102824-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-0) (medium, CVSS 4.3, published 29 Sep 2026) - [CVE-2026-102823: Russh SSH library channel ID validation bypass](https://junglewise.ai/threats/cve-2026-102823-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-1) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-102822: russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic](https://junglewise.ai/threats/cve-2026-102822-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-1-a) (low, CVSS 3.7, published 29 Sep 2026) - [CVE-2026-102821: Russh SSH library unbounded memory allocation during rekey](https://junglewise.ai/threats/cve-2026-102821-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-2-an) (medium, CVSS 6.5, published 29 Sep 2026) - [CVE-2026-73489: Russh denial of service via malformed PTY request](https://junglewise.ai/threats/cve-2026-73489-russh-denial-of-service-via-malformed-pty-request) (medium, CVSS 4.3, published 13 Aug 2026) - [CVE-2026-73430: Russh SSH library denial of service via malformed key exchange](https://junglewise.ai/threats/cve-2026-73430-russh-ssh-library-denial-of-service-via-malformed-key-exchange) (medium, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-73429: Russh SSH library Curve25519 key exchange denial of service](https://junglewise.ai/threats/cve-2026-73429-russh-ssh-library-curve25519-key-exchange-denial-of-service) (medium, CVSS 5.3, published 12 Aug 2026) - [CVE-2026-68930: Eugeny Russh channel-scoped callback bypass for unopened channels](https://junglewise.ai/threats/cve-2026-68930-eugeny-russh-channel-scoped-callback-bypass-for-unopened-channels) (medium, CVSS 6.5, published 3 Aug 2026) - [CVE-2026-48110: Russh resource exhaustion via improper input validation in SSH message handlers](https://junglewise.ai/threats/cve-2026-48110-russh-resource-exhaustion-via-improper-input-validation-in-ssh) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-48108: Eugeny Russh resource exhaustion in SSH identification parsing](https://junglewise.ai/threats/cve-2026-48108-eugeny-russh-resource-exhaustion-in-ssh-identification-parsing) (medium, CVSS 5.3, published 10 Jun 2026) - [CVE-2026-48107: Russh denial of service via unchecked prompt count in client auth path](https://junglewise.ai/threats/cve-2026-48107-russh-denial-of-service-via-unchecked-prompt-count-in-client-auth) (medium, CVSS 6.5, published 10 Jun 2026) - [CVE-2026-46705: Eugeny Russh authentication state mismatch in SSH server](https://junglewise.ai/threats/cve-2026-46705-eugeny-russh-authentication-state-mismatch-in-ssh-server) (medium, CVSS 5.3, published 10 Jun 2026) - [CVE-2026-46702: Eugeny Russh denial of service via unbounded SSH decompression](https://junglewise.ai/threats/cve-2026-46702-eugeny-russh-denial-of-service-via-unbounded-ssh-decompression) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-46673: Eugeny Russh denial of service via unchecked CryptoVec allocation](https://junglewise.ai/threats/cve-2026-46673-eugeny-russh-denial-of-service-via-unchecked-cryptovec-allocation) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-42189: Russh SSH library denial of service in keyboard-interactive auth](https://junglewise.ai/threats/cve-2026-42189-russh-ssh-library-denial-of-service-in-keyboard-interactive-auth) (high, CVSS 7.5, published 8 May 2026) - [CVE-2025-54804: russh is missing overflow checks during channel windows adjust](https://junglewise.ai/threats/cve-2025-54804-russh-is-missing-overflow-checks-during-channel-windows-adjust) (low, CVSS 3.1, published 4 Aug 2025) - [CVE-2024-43410: Russh has an OOM Denial of Service due to allocation of untrusted amount](https://junglewise.ai/threats/cve-2024-43410-russh-has-an-oom-denial-of-service-due-to-allocation-of-untrusted) (low, CVSS 3.1, published 14 Aug 2024) - [CVE-2023-48795: OpenSSH and others SSH prefix truncation vulnerability (Terrapin)](https://junglewise.ai/threats/cve-2023-48795-openssh-and-others-ssh-prefix-truncation-vulnerability-terrapin) (medium, CVSS 5.9, published 18 Dec 2023) ## Most severe russh (crates.io) vulnerabilities - [CVE-2026-42189: Russh SSH library denial of service in keyboard-interactive auth](https://junglewise.ai/threats/cve-2026-42189-russh-ssh-library-denial-of-service-in-keyboard-interactive-auth) (high, CVSS 7.5, published 8 May 2026) - [CVE-2026-48110: Russh resource exhaustion via improper input validation in SSH message handlers](https://junglewise.ai/threats/cve-2026-48110-russh-resource-exhaustion-via-improper-input-validation-in-ssh) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-46702: Eugeny Russh denial of service via unbounded SSH decompression](https://junglewise.ai/threats/cve-2026-46702-eugeny-russh-denial-of-service-via-unbounded-ssh-decompression) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-46673: Eugeny Russh denial of service via unchecked CryptoVec allocation](https://junglewise.ai/threats/cve-2026-46673-eugeny-russh-denial-of-service-via-unchecked-cryptovec-allocation) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-102823: Russh SSH library channel ID validation bypass](https://junglewise.ai/threats/cve-2026-102823-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-1) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-116794: russh SSH agent confirmation bypass](https://junglewise.ai/threats/cve-2026-116794-russh-is-a-rust-ssh-client-and-server-library-that-includes-an) (high, CVSS 4, published 28 Oct 2026) - [CVE-2026-48107: Russh denial of service via unchecked prompt count in client auth path](https://junglewise.ai/threats/cve-2026-48107-russh-denial-of-service-via-unchecked-prompt-count-in-client-auth) (medium, CVSS 6.5, published 10 Jun 2026) - [CVE-2026-68930: Eugeny Russh channel-scoped callback bypass for unopened channels](https://junglewise.ai/threats/cve-2026-68930-eugeny-russh-channel-scoped-callback-bypass-for-unopened-channels) (medium, CVSS 6.5, published 3 Aug 2026) - [CVE-2026-102821: Russh SSH library unbounded memory allocation during rekey](https://junglewise.ai/threats/cve-2026-102821-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-2-an) (medium, CVSS 6.5, published 29 Sep 2026) - [CVE-2023-48795: OpenSSH and others SSH prefix truncation vulnerability (Terrapin)](https://junglewise.ai/threats/cve-2023-48795-openssh-and-others-ssh-prefix-truncation-vulnerability-terrapin) (medium, CVSS 5.9, published 18 Dec 2023) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 20% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 5 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities - [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "russh (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/crates-io-russh, 13 November 2026.