CVE-2026-102823 russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
A malicious SSH server can trigger panics or corrupt exit-code tracking in russh clients by sending events for unopened channels.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102823?
CVE-2026-102823 is a high-severity vulnerability in Eugeny russh, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.
Weakness: CWE-20
Which versions are affected by CVE-2026-102823?
2 open source packages ship an affected version, including russh.
| Package | Affected | Fixed in |
|---|---|---|
russh crates.io | All versions | 0.63.1 |
russh crates.io | All versions | 0.63.1 |
How do I fix CVE-2026-102823?
Upgrade russh to 0.63.1 or later.
Is CVE-2026-102823 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102823 exists.
Sources
Also known as DEBIAN-CVE-2026-102823, GHSA-47hw-gvq5-r2gm, UBUNTU-CVE-2026-102823.