CVE-2026-42189
Pre-authentication DoS in Russh SSH Server Library
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| russh | russh | to 0.60.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-789 | The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Russh Rust SSH client and server library prior to version 0.60.1. It is a pre-authentication denial-of-service (DoS) vulnerability in the server's keyboard-interactive authentication handler.
A malicious client can send a single malformed packet to any russh-based server that uses keyboard-interactive authentication (such as for two-factor authentication or TOTP) and cause the server to crash without needing any credentials.
This issue was fixed in version 0.60.1 of the Russh library.
How can this vulnerability impact me? :
The vulnerability can cause a denial-of-service condition on any russh-based server implementing keyboard-interactive authentication.
- An attacker can crash the server with a single malformed packet without needing to authenticate.
- This can lead to service disruption, making the server unavailable to legitimate users.
- Repeated exploitation could result in extended downtime or require manual intervention to restore service.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the russh library to version 0.60.1 or later, where the pre-authentication denial-of-service issue in the keyboard-interactive authentication handler has been patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-42189 is a denial-of-service vulnerability that affects the availability of russh-based servers implementing keyboard-interactive authentication. While it does not impact confidentiality or integrity, the resulting server crashes could disrupt services that rely on this library.
Disruptions caused by this vulnerability could potentially affect compliance with standards like GDPR or HIPAA, which require maintaining availability and reliability of systems processing personal or sensitive data. However, the CVE description and resources do not explicitly discuss compliance implications.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring russh-based SSH servers for crashes or out-of-memory (OOM) events triggered by malformed keyboard-interactive authentication packets.
Since the attack involves sending a malicious SSH_MSG_USERAUTH_INFO_RESPONSE packet with an excessively large count value, detection can focus on unusual or malformed SSH authentication packets targeting keyboard-interactive authentication.
To detect attempts on your system, you can monitor server logs for repeated crashes or OOM kills related to the russh process.
Network-level detection could involve capturing SSH traffic and inspecting for unusually large or malformed keyboard-interactive authentication packets.
Example commands to help detect or investigate this vulnerability include:
- Check system logs for OOM kills or crashes related to the russh server process: `journalctl -u russh.service` or `dmesg | grep -i oom`
- Use packet capture tools like tcpdump to capture SSH traffic for analysis: `tcpdump -i <interface> port 22 -w ssh_capture.pcap`
- Analyze captured packets with Wireshark or tshark to filter for SSH_MSG_USERAUTH_INFO_RESPONSE packets and check for abnormal sizes or counts.
- Monitor russh server logs for repeated authentication failures or crashes.