assistant_daemon (0.1.0), async-ssh2-tokio (>=0.6.0, <=0.8.11) +6 more potentially affected by CVE-2026-48107 via russh (>=0.37.1, <=0.43.0)

russh CARGO version =0.37.1, =0.6.0, =0.1.0, =0.1.0, =2.0.0-beta.1, =2.0.3 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-48107 Source advisory: OSV:GHSA-G9G7-5CGW-6V28...

Linux Distros Unpatched Vulnerability : CVE-2026-48107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a...

CVE-2026-48107 Russh: Unchecked keyboard-interactive prompt count in client auth path

Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTHINFOREQUEST with an attacker-controlled prompt count, and the client would use that raw count direct...

CVE-2026-48107

creationtimestamp| type| source ---|---|--- 2026-05-20 22:48:53+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-g9g7-5cgw-6v28 2026-06-10 23:14:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxtnhsjxw2v...