CVE-2026-68930Medium· 6.5▾ SunlitRussh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
russh <= 0.62.4Patched in:
russh 0.62.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73429Medium· 5.3Russh is a Rust SSH client & server library
CVE-2026-73489Medium· 4.3Russh is a Rust SSH client & server library
CVE-2026-73430Medium· 5.3Russh is a Rust SSH client & server library
GHSA-5xvq-cp9x-6p6rMedium· 5.3Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
GHSA-cqjc-rmpq-xprqMedium· 4.3Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
GHSA-g9hv-x236-4qp3Medium· 5.3Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)