CVE-2026-102825

Deferred Deferred - Pending Action

Authentication Attempt Bypass in Russh SSH Library

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102825

EUVD

EUVD-2026-89365

Affected Vendors & Products

Vendor	Product	Version / Range
eugeny	russh	to 0.62.6 (exc)
eugeny	russh	0.62.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability in the Russh SSH library (versions 0.62.5 and earlier) allows unauthenticated remote clients to bypass the server's configured maximum authentication attempt limit. The issue occurs in the USERAUTH_REQUEST path where the server increments authentication attempts but fails to compare them against the configured cap. This enables repeated authentication requests beyond the intended limit, increasing exposure to online guessing attacks and adding unnecessary load to backend authentication systems.

Detection Guidance

To detect this vulnerability, monitor SSH authentication attempts on your server. Check if the configured max_auth_attempts limit is exceeded without disconnecting clients. Use commands like 'sshd -T | grep max_auth_attempts' to verify settings and 'journalctl -u sshd --no-pager | grep 'Failed password'' to review failed attempts.

Impact Analysis

The vulnerability increases the risk of brute-force attacks by allowing attackers to make unlimited authentication attempts on a single connection. This can lead to higher server load due to excessive authentication processing and potential account lockouts if backend systems enforce their own limits. However, it does not directly compromise confidentiality or integrity of data.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized access to personal or health data. However, it may indirectly affect compliance by weakening authentication controls, which are critical for access control requirements in both regulations. Organizations relying on russh for SSH access management may need to implement additional compensating controls to meet compliance standards.

Mitigation Strategies

Upgrade russh to version 0.62.6 or later to enforce max_auth_attempts. If upgrading is not possible, implement network-level rate limiting or fail2ban to block repeated failed attempts. Review SSH server logs for unusual authentication patterns.

Hi! I’m here to help you understand CVE-2026-102825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70