CVE-2026-48107: Russh Auth Bypass Vulnerability

CVE-2026-48107 Overview

CVE-2026-48107 affects Russh, a Rust SSH client and server library maintained by Eugeny. The vulnerability resides in the client-side keyboard-interactive authentication path. A malicious SSH server can send a USERAUTH_INFO_REQUEST message containing an attacker-controlled prompt count. The Russh client passes this raw count directly to Vec::with_capacity(...) before validating that the packet actually contains enough prompt data. The flaw impacts versions from 0.37.0 up to 0.61.0 and is tracked under [CWE-20] (Improper Input Validation). Maintainers addressed the issue in version 0.61.0.

Critical Impact
A hostile SSH server can trigger excessive memory allocation in connecting Russh clients, leading to a denial-of-service condition against client processes.

Affected Products

Russh versions 0.37.0 through 0.60.x
Rust applications embedding the Russh client library
SSH automation and tooling built on Russh client APIs

Discovery Timeline

2026-06-10 - CVE-2026-48107 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-48107

Vulnerability Analysis

The defect occurs during SSH keyboard-interactive authentication exchange. The SSH protocol allows a server to issue a USERAUTH_INFO_REQUEST packet that includes a num-prompts field. This field indicates how many interactive prompts the client should display to the user.

In affected Russh versions, the client reads the num-prompts value and passes it directly into Vec::with_capacity(num_prompts). The allocation happens before the client parses or validates the remaining prompt entries in the packet. A malicious server can set this count to an arbitrarily large value while sending a minimal packet body.

The result is a large pre-allocation request that can exhaust client process memory. The attack requires user interaction because the victim must initiate an SSH connection to the malicious server. The impact is limited to availability — confidentiality and integrity are not affected.

Root Cause

The root cause is improper input validation, classified under [CWE-20]. The Russh client trusts a server-supplied length field and uses it for memory pre-allocation without bounds checking. The validation step that confirms whether enough prompt data follows in the packet occurs after the allocation, not before.

Attack Vector

An attacker must operate or control an SSH server and induce a Russh-based client to connect to it. Once the keyboard-interactive authentication method is negotiated, the server sends a crafted USERAUTH_INFO_REQUEST with a maximal num-prompts value. The client process attempts the large allocation and either aborts or becomes unresponsive.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-g9g7-5cgw-6v28. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-48107

Indicators of Compromise

Russh client processes terminating with allocation failures or out-of-memory errors shortly after initiating an SSH session
Outbound SSH connections from automation hosts to unexpected or untrusted remote endpoints
Repeated client crashes correlated with connections to a specific SSH server endpoint

Detection Strategies

Inventory Rust binaries and applications that link against Russh, and identify versions below 0.61.0 using cargo audit or software composition analysis tools
Monitor process exit codes and memory usage metrics on hosts running Russh-based SSH clients
Inspect SSH client telemetry for keyboard-interactive authentication attempts to non-corporate destinations

Monitoring Recommendations

Enable verbose logging in Russh-based applications to capture authentication method negotiation
Alert on abnormal RSS or virtual memory growth in short-lived SSH client processes
Correlate outbound TCP/22 sessions with subsequent process crashes on the same host

How to Mitigate CVE-2026-48107

Immediate Actions Required

Upgrade all applications depending on Russh to version 0.61.0 or later
Audit Cargo.lock files across repositories and CI pipelines to identify transitive dependencies on vulnerable Russh versions
Restrict Russh-based clients from connecting to untrusted SSH endpoints until patched

Patch Information

The maintainers patched the issue in Russh version 0.61.0. The fix validates the prompt count against the available packet data before performing the Vec::with_capacity allocation. Refer to the GitHub Security Advisory GHSA-g9g7-5cgw-6v28 for the upstream remediation details.

Workarounds

Disable keyboard-interactive authentication in Russh client configurations where feasible, preferring public key authentication
Limit outbound SSH connectivity from automation hosts to an allowlist of known servers
Run Russh-based client processes under memory limits using ulimit or cgroup constraints to contain allocation abuse

bash

# Update the Russh dependency in Cargo.toml to the patched release
# Then refresh the lockfile and rebuild
cargo update -p russh --precise 0.61.0
cargo build --release

# Verify no vulnerable versions remain in the dependency tree
cargo tree -i russh