Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-102825: Russh library allows unlimited login attempts
CVE-2026-102825 · published 19 days ago
Summary
Versions of the Russh SSH library before 0.62.6 do not stop a remote client from sending more authentication attempts than the configured limit. This lets an attacker keep guessing passwords on a single connection, raising the chance of a successful guess and adding load to your authentication system. Update Russh to version 0.62.6 or later to enforce the attempt limit.
What to do
- Update eugeny russh to version 0.62.6.
- Update russh to version 0.62.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | eugeny | russh | < 0.62.6 |
| rust | eugeny | russh |
<= 0.62.5 Fix: upgrade to 0.62.6
|
| rust | – | russh |
<= 0.62.5 Fix: upgrade to 0.62.6
|
| Ubuntu:26.10 | canonical | rust-russh | All versions |
Original advisory text
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.
References
- https://ubuntu.com/security/CVE-2026-102825 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102825 Third Party Advisory
- https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35 Third Party Advisory
- https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653 Third Party Advisory
- https://github.com/Eugeny/russh/releases/tag/v0.62.6 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1028... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102825
- https://github.com/advisories/GHSA-g6xm-f9xp-qq35
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102825 · NVD
CVE-2026-102825 · MITRE
CVE-2026-102825 · OSV
GHSA-g6xm-f9xp-qq35 · GHSA
UBUNTU-CVE-2026-102825 · OSV
Track software like this
Free during beta