CVE-2026-102825

3.7 Faible

Publiée le 29/09/2026 à 21:17 · Modifiée le 30/09/2026 à 22:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.

Traduire en français

Produits concernés

Eugeny russh

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.7 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-307

Références

https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653
https://github.com/Eugeny/russh/releases/tag/v0.62.6
https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35
https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories