SSH Client & Server Library Vulnerability in Russh by Eugeny
CVE-2026-48108

5.3MEDIUM

Key Information:

Vendor

Eugeny

Status
Russh
Vendor
CVE Published:
10 June 2026

What is CVE-2026-48108?

The Russh library, a Rust-based SSH client and server library, has a vulnerability where it improperly handles the SSH identification-string rules. This flaw exists in versions from 0.34.0-beta.1 to prior to 0.61.0. In particular, the server-side identification reader is permissive and allows clients to send malformed identification input, including pre-banner lines, which should normally be invalid. This could result in a remote peer consuming connection setup resources during the cleartext pre-authentication phase. The issue has been resolved in version 0.61.0.

Affected Version(s)

russh >= 0.34.0-beta.1, < 0.61.0

References

https://github.com/Eugeny/russh/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.