CVE-2026-48108

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48108", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:46:58.287Z", "datePublished": "2026-06-10T20:24:56.666Z", "dateUpdated": "2026-06-11T13:50:36.699Z"}, "containers": {"cna": {"title": "Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": ">= 0.34.0-beta.1, < 0.61.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T20:24:56.666Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0."}], "source": {"advisory": "GHSA-76r6-x97p-67vr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T13:50:18.550639Z", "id": "CVE-2026-48108", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:50:36.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48108", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T13:50:18.550639Z"}}}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:49:48.894Z"}}], "cna": {"title": "Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input", "source": {"advisory": "GHSA-76r6-x97p-67vr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": ">= 0.34.0-beta.1, < 0.61.0"}]}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr", "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T20:24:56.666Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48108", "state": "PUBLISHED", "dateUpdated": "2026-06-11T13:50:36.699Z", "dateReserved": "2026-05-20T18:46:58.287Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-10T20:24:56.666Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": ">= 0.34.0-beta.1, < 0.61.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0."}, {"lang": "es", "value": "Russh es una biblioteca de cliente y servidor SSH de Rust. Desde la versi\u00f3n 0.34.0-beta.1 hasta antes de la versi\u00f3n 0.61.0, russh no aplicaba las reglas de cadena de identificaci\u00f3n SSH tan deliberadamente como OpenSSH. En particular, el lector de identificaci\u00f3n del lado del servidor utilizaba la misma ruta permisiva que el cliente, permitiendo l\u00edneas previas al banner de los clientes, y el lector no aplicaba un n\u00famero limitado de l\u00edneas previas al banner. Para un servidor de biblioteca construido sobre russh, esto podr\u00eda permitir a un par remoto mantener recursos de configuraci\u00f3n de conexi\u00f3n en la fase de pre-autenticaci\u00f3n de texto claro con una entrada de identificaci\u00f3n malformada que deber\u00eda haber sido rechazada tempranamente. Este problema ha sido parcheado en la versi\u00f3n 0.61.0."}], "id": "CVE-2026-48108", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48108", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T13:50:18.550639Z", "version": "2.0.3"}}]}, "published": "2026-06-10T22:17:01.130", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.34.0-beta.1,0.61.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "russh", "source": "cna", "vendor": "Eugeny"}, "product": "russh", "vendor": "eugeny"}], "created": "2026-06-10T22:45:27.366225+00:00", "updated": "2026-06-10T23:00:20.867343+00:00", "vendors": ["eugeny", "eugeny$PRODUCT$russh"]}