CVE-2026-102823

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102823", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T17:25:25.265Z", "datePublished": "2026-09-29T18:25:58.084Z", "dateUpdated": "2026-10-02T12:20:10.605Z"}, "containers": {"cna": {"title": "russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"}, {"name": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774"}, {"name": "https://github.com/Eugeny/russh/releases/tag/v0.63.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.1"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": "< 0.63.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T18:25:58.084Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1."}], "source": {"advisory": "GHSA-47hw-gvq5-r2gm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-02T12:19:44.206468Z", "id": "CVE-2026-102823", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T12:20:10.605Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102823", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T12:19:44.206468Z"}}}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T12:20:03.860Z"}}], "cna": {"title": "russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened", "source": {"advisory": "GHSA-47hw-gvq5-r2gm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": "< 0.63.1"}]}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm", "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774", "name": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Eugeny/russh/releases/tag/v0.63.1", "name": "https://github.com/Eugeny/russh/releases/tag/v0.63.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T18:25:58.084Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102823", "state": "PUBLISHED", "dateUpdated": "2026-10-02T12:20:10.605Z", "dateReserved": "2026-09-29T17:25:25.265Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-29T18:25:58.084Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": "< 0.63.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1."}], "id": "CVE-2026-102823", "lastModified": "2026-10-02T13:17:25.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102823", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-02T12:19:44.206468Z", "version": "2.0.3"}}]}, "published": "2026-09-29T19:17:24.367", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "russh: russh: State corruption via unverified SSH channel identifiers", "id": "2543503", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543503"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-841", "details": ["A flaw was found in russh, a Secure Shell (SSH) client and server library. When communicating with a client, a malicious SSH server can send channel lifecycle events referencing unverified, unopened, or closed channel identifiers. Because the library forwards these events to client handlers without verifying that the channel was established by the client, this flaw can cause application crashes, resulting in a Denial of Service (DoS), or corrupt command completion and exit status tracking."], "name": "CVE-2026-102823", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-29T18:25:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102823\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102823\nhttps://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\nhttps://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.63.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "russh", "source": "cna", "vendor": "Eugeny"}, "product": "russh", "vendor": "eugeny"}], "created": "2026-09-29T21:30:08.563185+00:00", "updated": "2026-09-30T08:45:16.726986+00:00", "vendors": ["eugeny", "eugeny$PRODUCT$russh"], "weaknesses": ["CWE-20", "CWE-841"]}