russh vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-111061Mediumrussh: russh: Unbounded memory allocation in agent protocol server via crafted constraint recordsCVE-2026-111062Lowrussh: A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestCVE-2026-102821Mediumrussh: Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyCVE-2026-102822Lowrussh: russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicCVE-2026-102823Highrussh: russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedCVE-2026-102824Mediumrussh: Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeCVE-2026-102825Lowrussh: Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathCVE-2026-68930Mediumrussh: Russh: Channel-scoped server callbacks can be reached without an open channelCVE-2026-73429Mediumrussh: Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)CVE-2026-73489Mediumrussh: Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsCVE-2026-73430Mediumrussh: Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)CVE-2026-48110Highrussh: Russh SSH message fields were decoded through allocation-first parsers before field-specific boundsCVE-2026-48108Mediumrussh: Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner inputCVE-2026-48107Mediumrussh: Russh: Unchecked keyboard-interactive prompt count in client auth pathCVE-2026-46705Mediumrussh: russh server userauth state is not reset when authentication principal changesCVE-2026-46702Highrussh: russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetsCVE-2026-46673Highrussh-cryptovec: Russh: Unchecked CryptoVec allocation and growth handling is reachableCVE-2026-42189Highrussh: russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handlerCVE-2025-54804Mediumrussh: russh is missing overflow checks during channel windows adjustCVE-2024-43410Highrussh: Russh has an OOM Denial of Service due to allocation of untrusted amountCVE-2023-48795Mediumrussh: Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinCVE-2023-28113Mediumrussh: russh may use insecure Diffie-Hellman keys

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo