russh vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48110Highrussh: Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds CVE-2026-48108Mediumrussh: Russh: SSH identification parsing accepted non-canonical client banners and did not bound…CVE-2026-48107Mediumrussh: Russh: Unchecked keyboard-interactive prompt count in client auth path CVE-2026-46705Mediumrussh: russh server userauth state is not reset when authentication principal changes CVE-2026-46702Highrussh: russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed…CVE-2026-46673Highrussh-cryptovec: Russh: Unchecked CryptoVec allocation and growth handling is reachable CVE-2026-42189Highrussh: russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler CVE-2025-54804Mediumrussh: russh is missing overflow checks during channel windows adjust CVE-2024-43410Highrussh: Russh has an OOM Denial of Service due to allocation of untrusted amount CVE-2023-48795Mediumrussh: Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-28113Mediumrussh: russh may use insecure Diffie-Hellman keys

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo