CVE-2026-42189

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42189", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T01:53:21.583Z", "datePublished": "2026-05-08T19:49:51.179Z", "dateUpdated": "2026-05-11T14:23:49.308Z"}, "containers": {"cna": {"title": "Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg"}, {"name": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1"}, {"name": "https://github.com/Eugeny/russh/releases/tag/v0.60.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.60.1"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": "< 0.60.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T19:49:51.179Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1."}], "source": {"advisory": "GHSA-f5v4-2wr6-hqmg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T14:23:22.063007Z", "id": "CVE-2026-42189", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T14:23:49.308Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42189", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T14:23:22.063007Z"}}}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T14:23:45.423Z"}}], "cna": {"title": "Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth", "source": {"advisory": "GHSA-f5v4-2wr6-hqmg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": "< 0.60.1"}]}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg", "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1", "name": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Eugeny/russh/releases/tag/v0.60.1", "name": "https://github.com/Eugeny/russh/releases/tag/v0.60.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T19:49:51.179Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42189", "state": "PUBLISHED", "dateUpdated": "2026-05-11T14:23:49.308Z", "dateReserved": "2026-04-25T01:53:21.583Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T19:49:51.179Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": "< 0.60.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:russh_project:russh:*:*:*:*:*:rust:*:*", "matchCriteriaId": "3B0C52D5-1F74-4959-9248-8CCE6309162E", "versionEndExcluding": "0.60.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:*", "matchCriteriaId": "449C9C44-332F-4C2C-A619-33C5025249DB", "versionEndExcluding": "0.23.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1."}, {"lang": "es", "value": "Russh es una biblioteca de cliente y servidor SSH de Rust. Antes de la versi\u00f3n 0.60.1, existe una vulnerabilidad de denegaci\u00f3n de servicio de preautenticaci\u00f3n en el gestor de autenticaci\u00f3n interactiva por teclado del servidor. Un cliente malicioso puede bloquear cualquier servidor basado en Russh que implemente autenticaci\u00f3n interactiva por teclado (p. ej., para 2FA/TOTP) con un \u00fanico paquete malformado, sin requerir credenciales. Este problema ha sido parcheado en la versi\u00f3n 0.60.1."}], "id": "CVE-2026-42189", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42189", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T14:23:22.063007Z", "version": "2.0.3"}}]}, "published": "2026-05-08T20:16:31.443", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.60.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.60.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "russh", "source": "cna", "vendor": "Eugeny"}, "product": "russh", "vendor": "eugeny"}], "created": "2026-05-08T22:30:18.334578+00:00", "updated": "2026-05-08T23:00:15.753007+00:00", "vendors": ["eugeny", "eugeny$PRODUCT$russh"]}