PT-2026-37172 · Russh · Russh

Coreyleavitt

·

Published

2026-04-24

·

Updated

2026-05-14

·

CVE-2026-42189

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.60.1
Description A pre-authentication denial-of-service issue exists in the server's keyboard-interactive authentication handler. A malicious client can crash any server based on this library that implements keyboard-interactive authentication (such as for 2FA/TOTP) by sending a single malformed packet without requiring credentials. The problem occurs in the read userauth info response() function within russh/src/server/encrypted.rs, where the server decodes a u32 count from the client's SSH MSG USERAUTH INFO RESPONSE and passes it directly to Vec::with capacity(). An attacker can provide a very large value for this count, forcing the server to attempt a massive memory allocation (e.g., 6.4GB), which leads to an Out-of-Memory (OOM) crash.
Recommendations Update to version 0.60.1. As a temporary workaround, restrict the use of the Handler::auth keyboard interactive implementation if it returns Auth::Partial until the update is applied.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789CWE-770

Related Identifiers

CVE-2026-42189
GHSA-F5V4-2WR6-HQMG

Affected Products

Russh