Security Advisory

CVE-2026-48107

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-10 20:23:45

Last updated 2026-06-11 13:05:20

Assigner GitHub_M

CVSS score 6.5

State PUBLISHED

Description

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTH_INFO_REQUEST with an attacker-controlled prompt count, and the client would use that raw count directly in Vec::with_capacity(...) before validating that enough prompt data was actually present in the packet. This issue has been patched in version 0.61.0.

← Browse all CVEs View on cve.org ↗