CVE-2026-102823

Deferred Deferred - Pending Action

SSH Channel Lifecycle Event Handling Flaw in Russh

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: GitHub, Inc.

Description

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102823

EUVD

EUVD-2026-89206

Affected Vendors & Products

Vendor	Product	Version / Range
russh	russh	0.63.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Russh Rust SSH library versions 0.63.0 and earlier. It allows a malicious SSH server to send spoofed channel lifecycle events (like CHANNEL_DATA, CHANNEL_CLOSE, or CHANNEL_REQUEST) for channel IDs that the client never opened. The client code does not validate if a channel exists before invoking handler callbacks, causing application crashes or state corruption.

Detection Guidance

To detect this vulnerability, check if your system uses russh library versions <= 0.63.0. Run commands like 'cargo tree -p russh' or 'cargo audit' to inspect dependencies for vulnerable versions. Monitor application logs for unexpected panics or crashes during SSH sessions, which may indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to crash your application, corrupt command tracking, or manipulate exit codes. If your software uses Russh for SSH automation, a malicious server could disrupt operations or alter expected behavior by sending forged channel events.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling integrity violations and denial-of-service attacks. Malicious SSH servers could forge channel lifecycle events, corrupting command completion and exit-code tracking, which may lead to unauthorized data access or processing errors. This could violate integrity requirements under GDPR Article 5 and HIPAA Security Rule standards for integrity and availability.

Mitigation Strategies

Upgrade russh to version 0.63.1 or later immediately. Update your Cargo.toml to specify russh >= 0.63.1 and run 'cargo update -p russh'. Review and test your SSH client applications to ensure they handle channel validation correctly after the update.

Hi! I’m here to help you understand CVE-2026-102823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70