State Management Flaw in Russh SSH Client & Server Library by Eugeny
CVE-2026-46705

5.3MEDIUM

Key Information:

Vendor

Eugeny

Status
Russh
Vendor
CVE Published:
10 June 2026

What is CVE-2026-46705?

The Russh SSH client & server library exhibits a state management flaw affecting versions between 0.34.0-beta.1 and prior to 0.61.0. The issue lies in the server's handling of user authentication, where it retains the internal user authentication state across SSH_MSG_USERAUTH_REQUEST messages without adequately isolating the state for different user or service names. This could potentially lead to unintended influences in subsequent authentication requests for different users or services, resulting in a mismatch of state information that should be isolated. This vulnerability has been addressed and resolved in version 0.61.0.

Affected Version(s)

russh >= 0.34.0-beta.1, < 0.61.0

References

https://github.com/Eugeny/russh/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.