Pre-authentication Denial-of-Service Vulnerability in Russh SSH Client & Server

CVE-2026-42189

What is CVE-2026-42189?

The Russh SSH client and server library is susceptible to a vulnerability that allows attackers to perform a pre-authentication denial-of-service attack. Specifically, prior to version 0.60.1, the server's keyboard-interactive authentication handler can be exploited by a malicious client sending a single malformed packet without needing any credentials. This vulnerability can cause a russh-based server implementing keyboard-interactive authentication, such as for two-factor authentication (2FA) or time-based one-time passwords (TOTP), to crash. The issue has been addressed in the release of version 0.60.1.

References