russh (crates.io)
Advisories
33
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.65 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p russh --precise 0.65Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vp5q-ff62-jwqv russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation |
High EPSS 0.16% |
< 0.65 | 0.65 |
| GHSA-vp5q-ff62-jwqv russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation |
High EPSS 0.16% |
< 0.65 | 0.65 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) |
Medium EPSS 0.26% |
>= 0.60.0, <= 0.64.1 | No fix yet |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) |
Medium EPSS 0.26% |
>= 0.60.0, < 0.65 | 0.65 |
| GHSA-9wfm-jcj8-jfv9 russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages |
Low EPSS 0.11% |
< 0.65.0 | 0.65.0 |
| GHSA-9wfm-jcj8-jfv9 russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages |
Low EPSS 0.11% |
< 0.65.0 | 0.65.0 |
| GHSA-4p9f-7p9m-5vfg russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets |
Medium EPSS 0.26% |
< 0.65 | 0.65 |
| GHSA-4p9f-7p9m-5vfg russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets |
Medium EPSS 0.26% |
< 0.65 | 0.65 |
| GHSA-4wc5-f2rc-q74m russh: Unbounded memory allocation in agent protocol server via crafted constraint records |
Medium EPSS 0.35% |
< 0.64.1 | 0.64.1 |
| GHSA-j7h2-66j4-ghjf A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request |
Low | >= 0.34.0-beta.1, < 0.64.0 | 0.64.0 |
| GHSA-g6xm-f9xp-qq35 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path |
Low EPSS 0.35% |
< 0.62.6 | 0.62.6 |
| GHSA-w3jg-pjxf-73p4 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange |
Medium EPSS 0.14% |
< 0.63.0 | 0.63.0 |
| GHSA-47hw-gvq5-r2gm russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened |
High EPSS 0.32% |
< 0.63.1 | 0.63.1 |
| GHSA-p8qx-h547-fjw9 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic |
Low EPSS 0.33% |
< 0.63.1 | 0.63.1 |
| GHSA-35g8-35p8-c8fw Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey |
Medium EPSS 0.36% |
< 0.63.2 | 0.63.2 |
| GHSA-m65r-rprj-r5rg Russh: Channel-scoped server callbacks can be reached without an open channel |
Medium EPSS 0.38% |
< 0.62.5 | 0.62.5 |
| GHSA-g9hv-x236-4qp3 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) |
Medium EPSS 0.51% |
< 0.62.4 | 0.62.4 |
| GHSA-cqjc-rmpq-xprq Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records |
Medium EPSS 0.45% |
< 0.62.4 | 0.62.4 |
| GHSA-5xvq-cp9x-6p6r Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB) |
Medium EPSS 0.60% |
< 0.62.4 | 0.62.4 |
| GHSA-4r3c-5hpg-58qr Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds |
High EPSS 0.37% |
>= 0.34.0, < 0.61.0 | 0.61.0 |
| GHSA-76r6-x97p-67vr Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input |
Medium EPSS 0.28% |
>= 0.34.0-beta.1, < 0.61.0 | 0.61.0 |
| GHSA-g9g7-5cgw-6v28 Russh: Unchecked keyboard-interactive prompt count in client auth path |
Medium EPSS 0.23% |
>= 0.37.0, < 0.61.0 | 0.61.0 |
| GHSA-hpv4-5h6f-wqr3 russh server userauth state is not reset when authentication principal changes |
Medium EPSS 0.22% |
>= 0.34.0-beta.1, < 0.61.0 | 0.61.0 |
| GHSA-wwx6-x28x-8259 russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets |
High EPSS 0.27% |
>= 0.34.0, < 0.61.1 | 0.61.1 |
| GHSA-g9f8-wqj9-fjw5 Russh: Unchecked CryptoVec allocation and growth handling is reachable |
High EPSS 0.26% |
< 0.60.3 | 0.60.3 |
| GHSA-g9f8-wqj9-fjw5 Russh: Unchecked CryptoVec allocation and growth handling is reachable |
High EPSS 0.26% |
>= 0.0.0-0, < 0.60.3 | 0.60.3 |
| GHSA-f5v4-2wr6-hqmg russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler |
High EPSS 0.48% |
< 0.60.1 | 0.60.1 |
| GHSA-h5rc-j5f5-3gcm russh is missing overflow checks during channel windows adjust |
Medium EPSS 0.42% |
< 0.54.1 | 0.54.1 |
| GHSA-vgvv-x7xg-6cqg Russh has an OOM Denial of Service due to allocation of untrusted amount |
High EPSS 0.91% |
< 0.44.1 | 0.44.1 |
| GHSA-45x7-px36-x8w8 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin |
Medium EPSS 93.55% |
< 0.40.2 | 0.40.2 |
| GHSA-45x7-px36-x8w8 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin |
Medium EPSS 93.55% |
< 0.40.2 | 0.40.2 |
| GHSA-cqvm-j2r2-hwpg russh may use insecure Diffie-Hellman keys |
Medium EPSS 0.64% |
< 0.36.2 | 0.36.2 |
| GHSA-cqvm-j2r2-hwpg russh may use insecure Diffie-Hellman keys |
Medium EPSS 0.64% |
>= 0.37.0, < 0.37.1 | 0.37.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor