Russh
Monthly
russh's SSH agent server signs with keys loaded under the confirm constraint without ever invoking the application's approval hook, so any process able to reach the agent socket - another local process running as the same user, or the remote host when the agent is forwarded with ssh -A - can authenticate or sign data as the user while the key stays loaded. The regression spans russh 0.50.0-beta.12 through 0.64.1 and only affects applications that override Agent::confirm with a real approval or policy check; the default always-true confirm and checks implemented in Agent::confirm_request remain effective, and the private key itself is never exposed. The vendor advisory ships a reproducible test PoC demonstrating the bypass (a unit test, not working exploit code); the issue is not listed in CISA KEV and active exploitation is not confirmed.
Improper validation in the Russh Rust SSH library (versions prior to 0.63.1) lets a malicious or compromised SSH server drive client-side channel lifecycle callbacks for channel identifiers the client never opened, never confirmed, or already released. The affected code path is client_read_authenticated in russh/src/client/encrypted.rs, which forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes (exit-status, exit-signal, xon-xoff) to public client::Handler callbacks without checking that the ChannelId belongs to a channel the client opened and established. Exploitation requires the russh-based application to act as an SSH client and connect to a server the attacker controls or has compromised - so risk concentrates in untrusted jump hosts, MITM positions, and automation that reaches attacker-influenced endpoints rather than arbitrary internet-facing victims; no public exploit code has been identified at time of analysis. Successful abuse can panic the application or corrupt command-completion and exit-code tracking, and the vendor assigns CVSS 7.5 while the independent assessment scores integrity and availability impact at High.
Denial of service in Russh (Rust SSH client/server library) versions 0.34.0 through 0.60.x allows remote SSH peers to trigger excessive memory allocation by sending oversized, high-fanout, or malformed length-prefixed SSH strings, name-lists, and byte fields before field-specific bounds checks are applied. The flaw affects both client and server message handlers and impacts availability only (CVSS 7.5, C:N/I:N/A:H). No public exploit identified at time of analysis.
Pre-authentication denial-of-service in russh SSH server library allows remote attackers to crash servers implementing keyboard-interactive authentication via a single malformed packet. Affects russh versions prior to 0.60.1. Attacker sends crafted SSH_MSG_USERAUTH_INFO_RESPONSE with inflated allocation count (e.g., 0x10000000), triggering multi-gigabyte memory allocation and OOM crash before any credential validation occurs. Vendor-released patch available (v0.60.1) bounds allocation to remaining packet data. Confirmed working exploit code exists per GitHub security advisory GHSA-f5v4-2wr6-hqmg. CVSS 7.5 (High) with network vector, low complexity, no privileges required.
Memory exhaustion in the pageant crate's raw PageantStream transport affects versions 0.2.0 through 0.2.4: PageantStream::new reads a peer-supplied four-byte length prefix and buffers up to len + 4 bytes without checking it against the fixed 8 KiB _AGENT_MAX_MSGLEN transport limit, so a malicious SSH server can claim a frame of up to ~4 GiB and either stream that much data or stall mid-frame, keeping the partial buffer resident. Exploitation is narrowly scoped - Windows only, and only for applications that bridge an SSH forwarded-agent channel directly to the raw stream (e.g. copy_bidirectional); russh's typed AgentClient path bounds frames at 256 KiB and is not affected. The advisory includes a proof-of-concept that the reporter observed growing a pageant 0.2.4 process from ~7.4 MB to ~264.7 MB working set on Windows 11; the flaw is fixed in pageant 0.2.5, no CISA KEV entry or active exploitation is reported, and the priority label is monitor with an assessed CVSS 3.1 of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Authenticated denial of service in russh 0.60.0 through 0.64.1: a client can open a session channel advertising a maximum packet size of zero, and any server write through Channel::data(), Channel::make_writer(), or Channel::into_stream() then remains pending forever instead of returning an error. A malicious server can cause the same silent stall in a client by confirming a channel with a zero maximum packet size. The vendor fixed the defect in 0.65.0 by rejecting zero at parse time; the advisory includes a verified end-to-end reproducer, no CISA KEV entry is reported, and this is assessed as a moderate-priority availability problem rather than a critical emergency.
Memory exhaustion in the russh Rust SSH library affects every release before 0.65.0: a malicious SSH server can send repeated pre-authentication EXT_INFO packets encoded with russh's private message number 7, and the client's handle_ext_info appends each parsed extension name to a per-session vector that is never cleared, deduplicated, or bounded, growing client heap for the lifetime of the connection. The victim must initiate a session with a hostile or compromised server (UI:R, PR:N), and the advisory reports that retention persists even after the client has verified the server's host key; impact is availability only (C:N/I:N/A:L, CVSS 4.3). The vendor shipped a fix in 0.65.0 and the advisory includes a reproduction harness exercising the real packet parser; there is no CISA KEV entry and no confirmed active exploitation, and no public exploit code is verified beyond that harness.
Unbounded, persistent memory retention in the russh SSH agent server (russh::keys::agent::server::serve) before 0.65.0 allows any process able to reach the agent socket to grow the agent's heap without limit by repeatedly submitting key-addition requests padded with SSH_AGENT_CONSTRAIN_CONFIRM (0x02) records. Each 1-byte record on the wire becomes a 56-byte retained Constraint::Confirm value inside the keystore, and because keys without a lifetime constraint never expire, that memory is never reclaimed for the life of the process. Severity is low and availability-only (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 3.3), the vendor fixed the issue in 0.65.0, there is no CISA KEV listing for this CVE, and the published GHSA advisory supplies a verified proof-of-concept harness rather than any indication of active exploitation.
Memory and task exhaustion in the russh SSH agent server (versions through 0.64.0) lets an unauthenticated attacker deny SSH agent service by sending a constrained add-key request packed with SSH_AGENT_CONSTRAIN_LIFETIME records. Each 5-byte lifetime record causes the agent to spawn a long-lived tokio task that clones the key blob, producing roughly 141x amplification; the public proof-of-concept in the advisory turned 10.2 MiB of protocol traffic into about 2.1 million live tasks and roughly 1.4 GB of RSS growth. Attackers can reach the agent socket locally or through agent forwarding to an attacker-controlled SSH server, and publicly available exploit code exists, though this is availability-only with no code execution or data disclosure.
Cryptographic weakness in the Russh SSH library before 0.63.0 lets a malicious remote SSH peer send an all-zero 32-byte X25519 public key during the hybrid ML-KEM-768 + X25519 key exchange, zeroing the classical half of the combined shared secret so the handshake is protected by ML-KEM-768 alone. Any deployment negotiating the mlkem768x25519 kex method is affected, and the flaw is reachable without authentication or user interaction because it triggers inside the key exchange itself (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The practical confidentiality impact is latent rather than immediate: no public exploit has been identified at time of analysis, and the exchange is only recoverable if ML-KEM-768 is independently weakened, so the real consequence today is the loss of the hybrid's classical fallback safety net.
Russh, the Rust SSH client and server library, can be driven into a panic-driven connection teardown by a remote peer whenever a deployment explicitly permits mac=none in its algorithm preferences. All releases prior to 0.63.1 are affected, because negotiation validated the cipher's needs_mac() requirement only on the MAC-selection-failure branch, allowing a MAC-requiring CTR or CBC cipher such as aes256-ctr to be paired with a zero-length MAC; the attacker then sends a packet with a decrypted length of zero, shrinking the buffer read in russh/src/cipher/mod.rs and panicking the indexing at buffer.buffer[16..]. The resulting impact is availability-only (the connection task terminates) with no code execution or data exposure, requires the non-default mac=none configuration and is rated high-complexity per the assessed AV:N/AC:H/PR:N/UI:N vector (unauthenticated remote attackers per the CVSS vector), and no public exploit code has been identified at time of analysis.
Memory exhaustion in the Russh Rust SSH client/server library prior to 0.63.2 allows an authenticated remote peer to stall the rekey state machine and flood SSH_MSG_CHANNEL_OPEN requests, causing ChannelOpenReply entries to accumulate on an unbounded channel until the process is terminated (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The attack requires a valid authenticated session first and abuses the SSH rekey window: the peer sends SSH_MSG_KEXINIT but withholds the required SSH_MSG_KEX_ECDH_INIT, leaving SessionKexState::InProgress so priority_receiver in russh/src/server/session.rs is never drained while the server keeps enqueuing replies. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation remains a moderate-priority availability concern gated by how trusted the server's authenticated user population is.
The Windows Pageant client inside the pageant Rust crate (pageant/src/wmmessage.rs) trusts a peer-controlled u32 response length read from the 8192-byte Pageant shared-memory mapping, so a local process that impersonates the Pageant window can drive MemoryMap::read to allocate up to roughly 4 GiB and copy past the end of the mapped view. In practice this reliably crashes a russh-based SSH client that queries the agent via AgentClient::connect_pageant, and can conditionally expose adjacent committed memory. The issue is fixed in pageant 0.2.3 (russh v0.63.2); exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2), with no CISA KEV entry and no public exploit identified at time of analysis.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial-of-service in russh's Curve25519 key exchange client path allows any malicious SSH server to crash a connecting russh client session deterministically and pre-authentication, before host key verification occurs. Affected are all russh client deployments running versions prior to 0.62.4. An attacker operating or controlling an SSH server can terminate the client's spawned session task with a single malformed KEX_ECDH_REPLY packet; a working proof-of-concept is included in the GHSA advisory. No public exploit identified at time of analysis for active exploitation, and CISA KEV listing is absent, but the attack is reliable, requires no authentication, and a POC is publicly available.
Resource exhaustion in Russh's SSH server identification-string reader allows unauthenticated remote attackers to hold connection setup resources indefinitely during the cleartext pre-authentication phase. Russh versions 0.34.0-beta.1 through 0.60.x used the same permissive identification reader for both client and server roles, failing to cap the number of pre-banner lines a connecting client could send before the SSH identification string - a constraint OpenSSH enforces strictly per RFC 4253. Any application serving SSH via russh is exposed to this pre-auth resource-holding condition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in Russh (versions 0.37.0-0.60.x), a Rust SSH client and server library, allows a malicious SSH server to crash connecting clients by exploiting improper input validation in the keyboard-interactive authentication path. The server supplies an attacker-controlled prompt count in a USERAUTH_INFO_REQUEST message, which the client passes directly to Vec::with_capacity() before verifying the packet contains the claimed number of prompts - resulting in a panic or out-of-memory condition that terminates the client process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Russh is a Rust SSH client & server library. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Russh is a Rust SSH client & server library. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
russh is a Rust SSH client and server library. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
russh's SSH agent server signs with keys loaded under the confirm constraint without ever invoking the application's approval hook, so any process able to reach the agent socket - another local process running as the same user, or the remote host when the agent is forwarded with ssh -A - can authenticate or sign data as the user while the key stays loaded. The regression spans russh 0.50.0-beta.12 through 0.64.1 and only affects applications that override Agent::confirm with a real approval or policy check; the default always-true confirm and checks implemented in Agent::confirm_request remain effective, and the private key itself is never exposed. The vendor advisory ships a reproducible test PoC demonstrating the bypass (a unit test, not working exploit code); the issue is not listed in CISA KEV and active exploitation is not confirmed.
Improper validation in the Russh Rust SSH library (versions prior to 0.63.1) lets a malicious or compromised SSH server drive client-side channel lifecycle callbacks for channel identifiers the client never opened, never confirmed, or already released. The affected code path is client_read_authenticated in russh/src/client/encrypted.rs, which forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes (exit-status, exit-signal, xon-xoff) to public client::Handler callbacks without checking that the ChannelId belongs to a channel the client opened and established. Exploitation requires the russh-based application to act as an SSH client and connect to a server the attacker controls or has compromised - so risk concentrates in untrusted jump hosts, MITM positions, and automation that reaches attacker-influenced endpoints rather than arbitrary internet-facing victims; no public exploit code has been identified at time of analysis. Successful abuse can panic the application or corrupt command-completion and exit-code tracking, and the vendor assigns CVSS 7.5 while the independent assessment scores integrity and availability impact at High.
Denial of service in Russh (Rust SSH client/server library) versions 0.34.0 through 0.60.x allows remote SSH peers to trigger excessive memory allocation by sending oversized, high-fanout, or malformed length-prefixed SSH strings, name-lists, and byte fields before field-specific bounds checks are applied. The flaw affects both client and server message handlers and impacts availability only (CVSS 7.5, C:N/I:N/A:H). No public exploit identified at time of analysis.
Pre-authentication denial-of-service in russh SSH server library allows remote attackers to crash servers implementing keyboard-interactive authentication via a single malformed packet. Affects russh versions prior to 0.60.1. Attacker sends crafted SSH_MSG_USERAUTH_INFO_RESPONSE with inflated allocation count (e.g., 0x10000000), triggering multi-gigabyte memory allocation and OOM crash before any credential validation occurs. Vendor-released patch available (v0.60.1) bounds allocation to remaining packet data. Confirmed working exploit code exists per GitHub security advisory GHSA-f5v4-2wr6-hqmg. CVSS 7.5 (High) with network vector, low complexity, no privileges required.
Memory exhaustion in the pageant crate's raw PageantStream transport affects versions 0.2.0 through 0.2.4: PageantStream::new reads a peer-supplied four-byte length prefix and buffers up to len + 4 bytes without checking it against the fixed 8 KiB _AGENT_MAX_MSGLEN transport limit, so a malicious SSH server can claim a frame of up to ~4 GiB and either stream that much data or stall mid-frame, keeping the partial buffer resident. Exploitation is narrowly scoped - Windows only, and only for applications that bridge an SSH forwarded-agent channel directly to the raw stream (e.g. copy_bidirectional); russh's typed AgentClient path bounds frames at 256 KiB and is not affected. The advisory includes a proof-of-concept that the reporter observed growing a pageant 0.2.4 process from ~7.4 MB to ~264.7 MB working set on Windows 11; the flaw is fixed in pageant 0.2.5, no CISA KEV entry or active exploitation is reported, and the priority label is monitor with an assessed CVSS 3.1 of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Authenticated denial of service in russh 0.60.0 through 0.64.1: a client can open a session channel advertising a maximum packet size of zero, and any server write through Channel::data(), Channel::make_writer(), or Channel::into_stream() then remains pending forever instead of returning an error. A malicious server can cause the same silent stall in a client by confirming a channel with a zero maximum packet size. The vendor fixed the defect in 0.65.0 by rejecting zero at parse time; the advisory includes a verified end-to-end reproducer, no CISA KEV entry is reported, and this is assessed as a moderate-priority availability problem rather than a critical emergency.
Memory exhaustion in the russh Rust SSH library affects every release before 0.65.0: a malicious SSH server can send repeated pre-authentication EXT_INFO packets encoded with russh's private message number 7, and the client's handle_ext_info appends each parsed extension name to a per-session vector that is never cleared, deduplicated, or bounded, growing client heap for the lifetime of the connection. The victim must initiate a session with a hostile or compromised server (UI:R, PR:N), and the advisory reports that retention persists even after the client has verified the server's host key; impact is availability only (C:N/I:N/A:L, CVSS 4.3). The vendor shipped a fix in 0.65.0 and the advisory includes a reproduction harness exercising the real packet parser; there is no CISA KEV entry and no confirmed active exploitation, and no public exploit code is verified beyond that harness.
Unbounded, persistent memory retention in the russh SSH agent server (russh::keys::agent::server::serve) before 0.65.0 allows any process able to reach the agent socket to grow the agent's heap without limit by repeatedly submitting key-addition requests padded with SSH_AGENT_CONSTRAIN_CONFIRM (0x02) records. Each 1-byte record on the wire becomes a 56-byte retained Constraint::Confirm value inside the keystore, and because keys without a lifetime constraint never expire, that memory is never reclaimed for the life of the process. Severity is low and availability-only (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 3.3), the vendor fixed the issue in 0.65.0, there is no CISA KEV listing for this CVE, and the published GHSA advisory supplies a verified proof-of-concept harness rather than any indication of active exploitation.
Memory and task exhaustion in the russh SSH agent server (versions through 0.64.0) lets an unauthenticated attacker deny SSH agent service by sending a constrained add-key request packed with SSH_AGENT_CONSTRAIN_LIFETIME records. Each 5-byte lifetime record causes the agent to spawn a long-lived tokio task that clones the key blob, producing roughly 141x amplification; the public proof-of-concept in the advisory turned 10.2 MiB of protocol traffic into about 2.1 million live tasks and roughly 1.4 GB of RSS growth. Attackers can reach the agent socket locally or through agent forwarding to an attacker-controlled SSH server, and publicly available exploit code exists, though this is availability-only with no code execution or data disclosure.
Cryptographic weakness in the Russh SSH library before 0.63.0 lets a malicious remote SSH peer send an all-zero 32-byte X25519 public key during the hybrid ML-KEM-768 + X25519 key exchange, zeroing the classical half of the combined shared secret so the handshake is protected by ML-KEM-768 alone. Any deployment negotiating the mlkem768x25519 kex method is affected, and the flaw is reachable without authentication or user interaction because it triggers inside the key exchange itself (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The practical confidentiality impact is latent rather than immediate: no public exploit has been identified at time of analysis, and the exchange is only recoverable if ML-KEM-768 is independently weakened, so the real consequence today is the loss of the hybrid's classical fallback safety net.
Russh, the Rust SSH client and server library, can be driven into a panic-driven connection teardown by a remote peer whenever a deployment explicitly permits mac=none in its algorithm preferences. All releases prior to 0.63.1 are affected, because negotiation validated the cipher's needs_mac() requirement only on the MAC-selection-failure branch, allowing a MAC-requiring CTR or CBC cipher such as aes256-ctr to be paired with a zero-length MAC; the attacker then sends a packet with a decrypted length of zero, shrinking the buffer read in russh/src/cipher/mod.rs and panicking the indexing at buffer.buffer[16..]. The resulting impact is availability-only (the connection task terminates) with no code execution or data exposure, requires the non-default mac=none configuration and is rated high-complexity per the assessed AV:N/AC:H/PR:N/UI:N vector (unauthenticated remote attackers per the CVSS vector), and no public exploit code has been identified at time of analysis.
Memory exhaustion in the Russh Rust SSH client/server library prior to 0.63.2 allows an authenticated remote peer to stall the rekey state machine and flood SSH_MSG_CHANNEL_OPEN requests, causing ChannelOpenReply entries to accumulate on an unbounded channel until the process is terminated (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The attack requires a valid authenticated session first and abuses the SSH rekey window: the peer sends SSH_MSG_KEXINIT but withholds the required SSH_MSG_KEX_ECDH_INIT, leaving SessionKexState::InProgress so priority_receiver in russh/src/server/session.rs is never drained while the server keeps enqueuing replies. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation remains a moderate-priority availability concern gated by how trusted the server's authenticated user population is.
The Windows Pageant client inside the pageant Rust crate (pageant/src/wmmessage.rs) trusts a peer-controlled u32 response length read from the 8192-byte Pageant shared-memory mapping, so a local process that impersonates the Pageant window can drive MemoryMap::read to allocate up to roughly 4 GiB and copy past the end of the mapped view. In practice this reliably crashes a russh-based SSH client that queries the agent via AgentClient::connect_pageant, and can conditionally expose adjacent committed memory. The issue is fixed in pageant 0.2.3 (russh v0.63.2); exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2), with no CISA KEV entry and no public exploit identified at time of analysis.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial-of-service in russh's Curve25519 key exchange client path allows any malicious SSH server to crash a connecting russh client session deterministically and pre-authentication, before host key verification occurs. Affected are all russh client deployments running versions prior to 0.62.4. An attacker operating or controlling an SSH server can terminate the client's spawned session task with a single malformed KEX_ECDH_REPLY packet; a working proof-of-concept is included in the GHSA advisory. No public exploit identified at time of analysis for active exploitation, and CISA KEV listing is absent, but the attack is reliable, requires no authentication, and a POC is publicly available.
Resource exhaustion in Russh's SSH server identification-string reader allows unauthenticated remote attackers to hold connection setup resources indefinitely during the cleartext pre-authentication phase. Russh versions 0.34.0-beta.1 through 0.60.x used the same permissive identification reader for both client and server roles, failing to cap the number of pre-banner lines a connecting client could send before the SSH identification string - a constraint OpenSSH enforces strictly per RFC 4253. Any application serving SSH via russh is exposed to this pre-auth resource-holding condition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in Russh (versions 0.37.0-0.60.x), a Rust SSH client and server library, allows a malicious SSH server to crash connecting clients by exploiting improper input validation in the keyboard-interactive authentication path. The server supplies an attacker-controlled prompt count in a USERAUTH_INFO_REQUEST message, which the client passes directly to Vec::with_capacity() before verifying the packet contains the claimed number of prompts - resulting in a panic or out-of-memory condition that terminates the client process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Russh is a Rust SSH client & server library. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Russh is a Rust SSH client & server library. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
russh is a Rust SSH client and server library. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.