CVE-2026-48107: Eugeny Russh

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTH_INFO_REQUEST with an attacker-controlled prompt count, and the client would use that raw count directly in Vec::with_capacity(...) before validating that enough prompt data was actually present in the packet. This issue has been patched in version 0.61.0.

Affected products

• Eugeny Russh: from 0.37.0, before 0.61.0 (fixed in 0.61.0)

Published 2026-06-10. Last modified 2026-07-23.