PT-2026-48546 · Russh · Russh
CVE-2026-48108
·
Published
2026-06-10
·
Updated
2026-06-12
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
russh versions 0.34.0-beta.1 through 0.60.0
Description
russh did not strictly enforce SSH identification-string rules. The server-side identification reader used a permissive path that allowed clients to send pre-banner lines and did not enforce a limit on the number of these lines. This allows a remote peer to consume connection setup resources during the cleartext pre-authentication phase by providing malformed identification input that should have been rejected. Additionally, this creates a parser-state oracle where a client can send multiple candidate identification lines; lines not recognized as SSH identification are discarded, while an accepted string advances the connection to key exchange. This behavior can be used to disclose server-side parser acceptance patterns and facilitate fingerprinting. The issue is located within the
read ssh id() function in russh/src/ssh read.rs and russh/src/server/mod.rs.Recommendations
Update russh to version 0.61.0.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Russh