EUVD-2026-36130
GHSA-76r6-x97p-67vr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable pre-auth SSH phase requires no credentials (PR:N) and no user interaction; impact is limited to partial availability with no confidentiality or integrity exposure.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0.
AnalysisAI
Resource exhaustion in Russh's SSH server identification-string reader allows unauthenticated remote attackers to hold connection setup resources indefinitely during the cleartext pre-authentication phase. Russh versions 0.34.0-beta.1 through 0.60.x used the same permissive identification reader for both client and server roles, failing to cap the number of pre-banner lines a connecting client could send before the SSH identification string - a constraint OpenSSH enforces strictly per RFC 4253. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - exploitation occurs entirely in the pre-authentication, cleartext SSH handshake phase before any credentials are exchanged (PR:N, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3 Medium) accurately reflects the threat profile: network-reachable, zero preconditions, no authentication, but limited to partial availability impact (A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connects to a russh-based SSH server and, instead of sending a well-formed SSH identification string, streams an unbounded sequence of pre-banner lines without ever completing the handshake. The server allocates and holds connection resources for each such session in the cleartext pre-authentication phase. … |
| Remediation | The vendor-released patch is Russh version 0.61.0, which enforces bounded pre-banner line handling on the server-side identification reader, aligning behavior with OpenSSH and RFC 4253. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today