CVE-2026-42189

⚠️ high

Summary

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.

CVSS Score

7.5

High

EPSS Score

0.2

Exploit Probability

Published Date

2026-05-08

First Seen: 2026-05-10

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.1% of all 321,566 vulnerabilities in our database.

#99,499

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 11, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-14

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-770 CWE-789

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
russh_project	russh	Affected	< 0.60.1
warpgate_project	warpgate	Affected	< 0.23.1

🔗 References 3

https://github.com/Eugeny/russh/commit/6c3c80a9b6d60...

Patch

https://github.com/Eugeny/russh/releases/tag/v0.60.1

Product Release Notes

https://github.com/Eugeny/russh/security/advisories/...

Exploit Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-44347	🔶 medium	5.8	0.0	Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate ...	2026-05-12
CVE-2025-54804	🔶 medium	6.5	0.1	Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH ...	2025-08-05
CVE-2024-43410	⚠️ high	7.5	0.6	Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to...	2024-08-21
CVE-2023-48795	🔶 medium	5.9	59.0	The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot...	2023-12-18
CVE-2023-48712	⚠️ high	7.1	0.2	Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escala...	2023-11-24
CVE-2023-43660	🔶 medium	4.8	0.0	Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verif...	2023-09-27

These CVEs affect the same products