Rust SSH Client & Server Library Vulnerability in Russh
CVE-2026-68930

6.5MEDIUM

Key Information:

Vendor

Eugeny

Status
Russh
Vendor
CVE Published:
3 August 2026

What is CVE-2026-68930?

The Russh library, utilized for implementing SSH functionalities in Rust, has a vulnerability where it dispatches channel-scoped Handler callbacks for recipient channel IDs that have never been opened or confirmed. This issue affects the integrity of channel communication and could potentially be exploited if left unpatched. The vulnerability was addressed in version 0.62.5, which ensures that only valid channels are managed properly during execution requests.

Affected Version(s)

russh < 0.62.5

References

https://github.com/Eugeny/russh/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/7c5659f8cf6f6f2f99...
x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.62.5
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.