assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46705 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46705 Source advisory: OSV:GHSA-HPV4-5H6F-WQR3...

GHSA-HPV4-5H6F-WQR3 russh server userauth state is not reset when authentication principal changes

Summary The russh server authentication path keeps internal userauth state across SSHMSGUSERAUTHREQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that...

russh server userauth state is not reset when authentication principal changes

Summary The russh server authentication path keeps internal userauth state across SSHMSGUSERAUTHREQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that...

GHSA-WWX6-X28X-8259 russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

Summary When SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46702 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46702 Source advisory: OSV:GHSA-WWX6-X28X-8259...

russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

Summary When SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In...

PT-2026-45017

Name of the Vulnerable Software and Affected Versions russh versions 0.34.0 through 0.61.0 Description When SSH compression is enabled, the software accepts compressed packets that pass initial transport packet-length checks but expand to a much larger size upon decompression. This occurs because...

PT-2026-45018

Name of the Vulnerable Software and Affected Versions Russh versions 0.34.0-beta.1 through 0.60.x Description The server authentication path in the Russh library fails to separate internal user authentication state when the request principal changes across SSH MSG USERAUTH REQUEST messages...

CVE-2026-46702

creationtimestamp| type| source ---|---|--- 2026-05-23 07:53:38+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259 2026-06-10 22:48:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxs62eub52l 2026-06-11 03:00:36+00:00| seen...

Russh: Unchecked CryptoVec allocation and growth handling is reachable

Title Unchecked CryptoVec allocation and growth handling was reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases Summary CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +9 more potentially affected by CVE-2026-46673 via russh-cryptovec (0.7.3)

russh-cryptovec CARGO version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on russh-cryptovec and may be impacted: - assistantdaemon 0.1.0 - async-ssh2-tokio =0.2.0, =0.1.0, =0.1.0, =0.34.0-beta.1, =0.22.0-beta.1, =0.2.0, =0.1.0, =0.4.1 - sshrpc...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46673 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46673 Source advisory: OSV:GHSA-G9F8-WQJ9-FJW5...

GHSA-G9F8-WQJ9-FJW5 Russh: Unchecked CryptoVec allocation and growth handling is reachable

Title Unchecked CryptoVec allocation and growth handling was reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases Summary CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths...

PT-2026-42625

Title Unchecked CryptoVec allocation and growth handling was reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases Summary CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths...

CVE-2026-46705

creationtimestamp| type| source ---|---|--- 2026-05-20 22:48:47+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3 2026-06-10 23:00:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxsulhtsc2f...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +9 more potentially affected by CVE-2026-46673 via russh-cryptovec (0.7.3)

russh-cryptovec CARGO version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on russh-cryptovec and may be impacted: - assistantdaemon 0.1.0 - async-ssh2-tokio =0.2.0, =0.1.0, =0.1.0, =0.34.0-beta.1, =0.22.0-beta.1, =0.2.0, =0.1.0, =0.4.1 - sshrpc...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46673 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46673 Source advisory: OSV:RUSTSEC-2026-0154...

RUSTSEC-2026-0153 Unchecked `CryptoVec` allocation and growth handling

CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation and locking paths. In affected russh releases, attacker-controlled input could reach these code paths through buffer resizing operations. Two affected reachability paths were identified: Current russh...

Unchecked `CryptoVec` allocation and growth handling

CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation and locking paths. In affected russh releases, attacker-controlled input could reach these code paths through buffer resizing operations. Two affected reachability paths were identified: Current russh...

CVE-2026-42189

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth e.g., for...