Executive Summary

This vulnerability exists in the Russh Rust SSH client and server library prior to version 0.60.1. It is a pre-authentication denial-of-service (DoS) vulnerability in the server's keyboard-interactive authentication handler.

A malicious client can send a single malformed packet to any russh-based server that uses keyboard-interactive authentication (such as for two-factor authentication or TOTP) and cause the server to crash without needing any credentials.

This issue was fixed in version 0.60.1 of the Russh library.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial-of-service condition on any russh-based server implementing keyboard-interactive authentication.

• An attacker can crash the server with a single malformed packet without needing to authenticate.
• This can lead to service disruption, making the server unavailable to legitimate users.
• Repeated exploitation could result in extended downtime or require manual intervention to restore service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the russh library to version 0.60.1 or later, where the pre-authentication denial-of-service issue in the keyboard-interactive authentication handler has been patched.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-42189 is a denial-of-service vulnerability that affects the availability of russh-based servers implementing keyboard-interactive authentication. While it does not impact confidentiality or integrity, the resulting server crashes could disrupt services that rely on this library.

Disruptions caused by this vulnerability could potentially affect compliance with standards like GDPR or HIPAA, which require maintaining availability and reliability of systems processing personal or sensitive data. However, the CVE description and resources do not explicitly discuss compliance implications.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring russh-based SSH servers for crashes or out-of-memory (OOM) events triggered by malformed keyboard-interactive authentication packets.

Since the attack involves sending a malicious SSH_MSG_USERAUTH_INFO_RESPONSE packet with an excessively large count value, detection can focus on unusual or malformed SSH authentication packets targeting keyboard-interactive authentication.

To detect attempts on your system, you can monitor server logs for repeated crashes or OOM kills related to the russh process.

Network-level detection could involve capturing SSH traffic and inspecting for unusually large or malformed keyboard-interactive authentication packets.

Example commands to help detect or investigate this vulnerability include:

• Check system logs for OOM kills or crashes related to the russh server process: `journalctl -u russh.service` or `dmesg | grep -i oom`
• Use packet capture tools like tcpdump to capture SSH traffic for analysis: `tcpdump -i <interface> port 22 -w ssh_capture.pcap`
• Analyze captured packets with Wireshark or tshark to filter for SSH_MSG_USERAUTH_INFO_RESPONSE packets and check for abnormal sizes or counts.
• Monitor russh server logs for repeated authentication failures or crashes.

Useful 0 Not Useful 0