russh has 12 CVEs on record. Cadence is steady at roughly 5 per quarter. The busiest recent month was August 2026 with 4. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-754 (4) and CWE-20 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 5 prev 7
Worst active — by depth score
CVE-2026-48110High· 7.5Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds41CVE-2026-46673High· 7.5Unbounded 32-bit allocation41CVE-2026-68930Medium· 6.5Russh is a Rust SSH client & server library36CVE-2026-48107Medium· 6.5Russh: Unchecked keyboard-interactive prompt count in client auth path36CVE-2026-73430Medium· 5.3Russh is a Rust SSH client & server library29
russh vulnerabilities
CVEs affecting russh, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-111062LowA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
CVE-2026-73489Medium· 4.3Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypt…
CVE-2026-73429Medium· 5.3Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve255…
CVE-2026-73430Medium· 5.3Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve…
CVE-2026-68930Medium· 6.5Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, an…
GHSA-5xvq-cp9x-6p6rMedium· 5.3Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
GHSA-cqjc-rmpq-xprqMedium· 4.3Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
GHSA-g9hv-x236-4qp3Medium· 5.3Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
CVE-2026-48107Medium· 6.5Russh: Unchecked keyboard-interactive prompt count in client auth path
Russh: Unchecked keyboard-interactive prompt count in client auth path
CVE-2026-48108Medium· 5.3Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
CVE-2026-48110High· 7.5Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds
Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds
CVE-2026-46673High· 7.5Unbounded 32-bit allocation
Unbounded 32-bit allocation