CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
An unauthenticated remote attacker can bypass configured authentication attempt limits in the Russh SSH library, enabling brute-force attacks and increasing server workload.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102825?
CVE-2026-102825 is a low-severity vulnerability in Eugeny russh, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.
Weakness: CWE-307
Which versions are affected by CVE-2026-102825?
2 open source packages ship an affected version, including russh.
| Package | Affected | Fixed in |
|---|---|---|
russh crates.io | All versions | 0.62.6 |
russh crates.io | All versions | 0.62.6 |
How do I fix CVE-2026-102825?
Upgrade russh to 0.62.6 or later.
Is CVE-2026-102825 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102825 exists.
Sources
Also known as DEBIAN-CVE-2026-102825, GHSA-g6xm-f9xp-qq35, UBUNTU-CVE-2026-102825.