Vulnerability-Lookup

RHSA-2026:74586

Vulnerability from csaf_redhat - Published: 2026-10-01 17:20 - Updated: 2026-10-02 10:21

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: openshell: * openshell-0.1.2-0.2.hum1 (aarch64, x86_64) * openshell-gateway-0.1.2-0.2.hum1 (aarch64, x86_64) * python3-openshell-0.1.2-0.2.hum1 (aarch64, x86_64) * openshell-0.1.2-0.2.hum1.src (src) Security Fix(es): openshell: * CVE-2026-102824 * CVE-2026-102821 * CVE-2026-102823

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-102821

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service (DoS) by initiating a Secure Shell (SSH) key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the internal queue during the stalled key exchange, system memory is continuously consumed until the process terminates.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-102823

A flaw was found in russh, a Secure Shell (SSH) client and server library. When communicating with a client, a malicious SSH server can send channel lifecycle events referencing unverified, unopened, or closed channel identifiers. Because the library forwards these events to client handlers without verifying that the channel was established by the client, this flaw can cause application crashes, resulting in a Denial of Service (DoS), or corrupt command completion and exit status tracking.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-841 - Improper Enforcement of Behavioral Workflow

Affected products

Fixed 7 products, the same list as for CVE-2026-102821

Threats

Impact Important

CVE-2026-102824

A flaw was found in russh. The library fails to validate peer public keys during hybrid cryptographic key exchange, accepting an all-zero key. A remote attacker acting as a malicious Secure Shell (SSH) peer can exploit this flaw during connection negotiation to force the classical encryption component of the shared secret to zero. This causes the connection to rely entirely on post-quantum algorithms, undermining the intended fallback protection of the hybrid exchange and weakening session security.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 7 products, the same list as for CVE-2026-102821

Threats

Impact Moderate

CVE-2026-102825

A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker to bypass authentication attempt limits, facilitating brute-force credential guessing and placing an excessive workload on backend authentication systems.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Affected products

Fixed 7 products, the same list as for CVE-2026-102821

Threats

Impact Low

References

36 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:74586	self
https://access.redhat.com/security/cve/CVE-2026-102821	external
https://access.redhat.com/security/cve/CVE-2026-102823	external
https://access.redhat.com/security/cve/CVE-2026-102824	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-102825	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-102821	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543501	external
https://www.cve.org/CVERecord?id=CVE-2026-102821	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102821	external
https://github.com/Eugeny/russh/commit/a282af361a…	external
https://github.com/Eugeny/russh/releases/tag/v0.63.2	external
https://github.com/Eugeny/russh/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-102823	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543503	external
https://www.cve.org/CVERecord?id=CVE-2026-102823	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102823	external
https://github.com/Eugeny/russh/commit/3430fd26ec…	external
https://github.com/Eugeny/russh/releases/tag/v0.63.1	external
https://github.com/Eugeny/russh/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-102824	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543498	external
https://www.cve.org/CVERecord?id=CVE-2026-102824	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102824	external
https://github.com/Eugeny/russh/commit/8da8967f19…	external
https://github.com/Eugeny/russh/releases/tag/v0.63.0	external
https://github.com/Eugeny/russh/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-102825	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543507	external
https://www.cve.org/CVERecord?id=CVE-2026-102825	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102825	external
https://github.com/Eugeny/russh/commit/f8fd0b11a3…	external
https://github.com/Eugeny/russh/releases/tag/v0.62.6	external
https://github.com/Eugeny/russh/security/advisori…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nopenshell:\n  * openshell-0.1.2-0.2.hum1 (aarch64, x86_64)\n  * openshell-gateway-0.1.2-0.2.hum1 (aarch64, x86_64)\n  * python3-openshell-0.1.2-0.2.hum1 (aarch64, x86_64)\n  * openshell-0.1.2-0.2.hum1.src (src)\n\nSecurity Fix(es):\n\nopenshell:\n  * CVE-2026-102824\n  * CVE-2026-102821\n  * CVE-2026-102823",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:74586",
        "url": "https://access.redhat.com/errata/RHSA-2026:74586"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102821",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102821"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102823",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102823"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102824",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102824"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102825",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102825"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74586.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-10-02T10:21:21+00:00",
      "generator": {
        "date": "2026-10-02T10:21:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:74586",
      "initial_release_date": "2026-10-01T17:20:02+00:00",
      "revision_history": [
        {
          "date": "2026-10-01T17:20:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-01T18:11:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-02T10:21:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshell-0:0.1.2-0.2.hum1@aarch64",
                "product": {
                  "name": "openshell-0:0.1.2-0.2.hum1@aarch64",
                  "product_id": "openshell-0:0.1.2-0.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshell@0.1.2-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
                "product": {
                  "name": "openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
                  "product_id": "openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshell-gateway@0.1.2-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-openshell-0:0.1.2-0.2.hum1@aarch64",
                "product": {
                  "name": "python3-openshell-0:0.1.2-0.2.hum1@aarch64",
                  "product_id": "python3-openshell-0:0.1.2-0.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-openshell@0.1.2-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshell-0:0.1.2-0.2.hum1@src",
                "product": {
                  "name": "openshell-0:0.1.2-0.2.hum1@src",
                  "product_id": "openshell-0:0.1.2-0.2.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshell@0.1.2-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshell-0:0.1.2-0.2.hum1@x86_64",
                "product": {
                  "name": "openshell-0:0.1.2-0.2.hum1@x86_64",
                  "product_id": "openshell-0:0.1.2-0.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshell@0.1.2-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
                "product": {
                  "name": "openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
                  "product_id": "openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshell-gateway@0.1.2-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-openshell-0:0.1.2-0.2.hum1@x86_64",
                "product": {
                  "name": "python3-openshell-0:0.1.2-0.2.hum1@x86_64",
                  "product_id": "python3-openshell-0:0.1.2-0.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-openshell@0.1.2-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshell-0:0.1.2-0.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64"
        },
        "product_reference": "openshell-0:0.1.2-0.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshell-0:0.1.2-0.2.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src"
        },
        "product_reference": "openshell-0:0.1.2-0.2.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshell-0:0.1.2-0.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64"
        },
        "product_reference": "openshell-0:0.1.2-0.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshell-gateway-0:0.1.2-0.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64"
        },
        "product_reference": "openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshell-gateway-0:0.1.2-0.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64"
        },
        "product_reference": "openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-openshell-0:0.1.2-0.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64"
        },
        "product_reference": "python3-openshell-0:0.1.2-0.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-openshell-0:0.1.2-0.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
        },
        "product_reference": "python3-openshell-0:0.1.2-0.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-102821",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-29T18:32:39.119757+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543501"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service (DoS) by initiating a Secure Shell (SSH) key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the internal queue during the stalled key exchange, system memory is continuously consumed until the process terminates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The russh crate is included as a dependency of openshell in Hummingbird. The flaw has been addressed via the hummingbird tracker.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543501",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543501"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102821"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b",
          "url": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/releases/tag/v0.63.2",
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw",
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"
        }
      ],
      "release_date": "2026-09-29T18:21:21.858000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T17:20:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74586"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation"
    },
    {
      "cve": "CVE-2026-102823",
      "cwe": {
        "id": "CWE-841",
        "name": "Improper Enforcement of Behavioral Workflow"
      },
      "discovery_date": "2026-09-29T18:32:18.193712+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543503"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in russh, a Secure Shell (SSH) client and server library. When communicating with a client, a malicious SSH server can send channel lifecycle events referencing unverified, unopened, or closed channel identifiers. Because the library forwards these events to client handlers without verifying that the channel was established by the client, this flaw can cause application crashes, resulting in a Denial of Service (DoS), or corrupt command completion and exit status tracking.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "russh: russh: State corruption via unverified SSH channel identifiers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The russh crate is included as a dependency of openshell in Hummingbird. The flaw has been addressed via the hummingbird tracker.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102823"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543503",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543503"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102823",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102823"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102823",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102823"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774",
          "url": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/releases/tag/v0.63.1",
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm",
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"
        }
      ],
      "release_date": "2026-09-29T18:25:58.084000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T17:20:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74586"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "russh: russh: State corruption via unverified SSH channel identifiers"
    },
    {
      "cve": "CVE-2026-102824",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-09-29T18:31:30.957684+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543498"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in russh. The library fails to validate peer public keys during hybrid cryptographic key exchange, accepting an all-zero key. A remote attacker acting as a malicious Secure Shell (SSH) peer can exploit this flaw during connection negotiation to force the classical encryption component of the shared secret to zero. This causes the connection to rely entirely on post-quantum algorithms, undermining the intended fallback protection of the hybrid exchange and weakening session security.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "russh: russh: Cryptographic fallback bypass via missing public key validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543498",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543498"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102824"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c",
          "url": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/releases/tag/v0.63.0",
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4",
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4"
        }
      ],
      "release_date": "2026-09-29T18:27:41.650000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T17:20:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74586"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "russh: russh: Cryptographic fallback bypass via missing public key validation"
    },
    {
      "cve": "CVE-2026-102825",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "discovery_date": "2026-09-29T18:51:29.316973+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543507"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker to bypass authentication attempt limits, facilitating brute-force credential guessing and placing an excessive workload on backend authentication systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "russh: russh: Authentication attempt limit bypass via unenforced maximum authentication attempts",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The russh crate is included as a dependency of openshell in Hummingbird. The flaw has been addressed via tracker HUM-9177.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
          "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
          "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102825"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543507",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543507"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102825",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102825"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102825",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102825"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653",
          "url": "https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/releases/tag/v0.62.6",
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.62.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35",
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35"
        }
      ],
      "release_date": "2026-09-29T18:31:32.393000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T17:20:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74586"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@src",
            "Red Hat Hardened Images:openshell-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:openshell-gateway-0:0.1.2-0.2.hum1@x86_64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@aarch64",
            "Red Hat Hardened Images:python3-openshell-0:0.1.2-0.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "russh: russh: Authentication attempt limit bypass via unenforced maximum authentication attempts"
    }
  ]
}

CVE-2026-102821 (GCVE-0-2026-102821)

Vulnerability from cvelistv5 – Published: 2026-09-29 18:21 – Updated: 2026-09-30 19:35

Title

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Summary

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:34 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/Eugeny/russh/security/advisori…	x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/a282af361a…	x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.63.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Eugeny	russh	Affected: < 0.63.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102821",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:34:47.748081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:35:02.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.63.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T18:21:21.858Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.63.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.2"
        }
      ],
      "source": {
        "advisory": "GHSA-35g8-35p8-c8fw",
        "discovery": "UNKNOWN"
      },
      "title": "Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102821",
    "datePublished": "2026-09-29T18:21:21.858Z",
    "dateReserved": "2026-09-29T17:25:25.265Z",
    "dateUpdated": "2026-09-30T19:35:02.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102823 (GCVE-0-2026-102823)

Vulnerability from cvelistv5 – Published: 2026-09-29 18:25 – Updated: 2026-10-02 12:20

Title

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Summary

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 12:19 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/Eugeny/russh/security/advisori…	x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/3430fd26ec…	x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.63.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Eugeny	russh	Affected: < 0.63.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102823",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T12:19:44.206468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T12:20:10.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.63.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T18:25:58.084Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.63.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.1"
        }
      ],
      "source": {
        "advisory": "GHSA-47hw-gvq5-r2gm",
        "discovery": "UNKNOWN"
      },
      "title": "russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102823",
    "datePublished": "2026-09-29T18:25:58.084Z",
    "dateReserved": "2026-09-29T17:25:25.265Z",
    "dateUpdated": "2026-10-02T12:20:10.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102824 (GCVE-0-2026-102824)

Vulnerability from cvelistv5 – Published: 2026-09-29 18:27 – Updated: 2026-09-30 20:24

Title

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Summary

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 20:24 UTC

CWE

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/Eugeny/russh/security/advisori…	x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/8da8967f19…	x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.63.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Eugeny	russh	Affected: < 0.63.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102824",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T20:24:54.936526Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T20:24:58.381Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.63.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange\u0027s intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-327",
              "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T18:27:41.650Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.63.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w3jg-pjxf-73p4",
        "discovery": "UNKNOWN"
      },
      "title": "Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102824",
    "datePublished": "2026-09-29T18:27:41.650Z",
    "dateReserved": "2026-09-29T17:25:25.265Z",
    "dateUpdated": "2026-09-30T20:24:58.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102825 (GCVE-0-2026-102825)

Vulnerability from cvelistv5 – Published: 2026-09-29 18:31 – Updated: 2026-09-30 19:29

Title

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Summary

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:29 UTC

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/Eugeny/russh/security/advisori…	x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/f8fd0b11a3…	x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.62.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Eugeny	russh	Affected: < 0.62.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102825",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:29:11.461462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:29:26.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.62.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment\u0027s attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T18:31:32.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.62.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.62.6"
        }
      ],
      "source": {
        "advisory": "GHSA-g6xm-f9xp-qq35",
        "discovery": "UNKNOWN"
      },
      "title": "Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102825",
    "datePublished": "2026-09-29T18:31:32.393Z",
    "dateReserved": "2026-09-29T17:25:25.265Z",
    "dateUpdated": "2026-09-30T19:29:26.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:74586

CVE-2026-102821 (GCVE-0-2026-102821)

CVE-2026-102823 (GCVE-0-2026-102823)

CVE-2026-102824 (GCVE-0-2026-102824)

CVE-2026-102825 (GCVE-0-2026-102825)

Tags

Sightings

Nomenclature

Related by attack behaviour