{"answers":{"affected":"2 open source packages ship an affected version, including russh.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102825 exists.","fix":"Upgrade russh to 0.62.6 or later.","what":"CVE-2026-102825 is a low-severity vulnerability in Eugeny russh, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-102825 and fix it if it is affected.\n\nWhat it is: CVE-2026-102825 is a low-severity vulnerability in Eugeny russh, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102825 exists.\n\nAffected packages and fixed versions:\n- russh (crates.io): affected all versions; fixed in 0.62.6\n- russh (crates.io): affected all versions; fixed in 0.62.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-102825/ (Markdown: https://insights.sbomify.com/CVE-2026-102825/index.md)","id":"CVE-2026-102825","markdown":"https://insights.sbomify.com/CVE-2026-102825/index.md","name":"CVE-2026-102825","record":{"aliases":["DEBIAN-CVE-2026-102825","GHSA-g6xm-f9xp-qq35","UBUNTU-CVE-2026-102825"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust SSH library","requires_auth":"none","summary":"An unauthenticated remote attacker can bypass configured authentication attempt limits in the Russh SSH library, enabling brute-force attacks and increasing server workload.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-307","name":"Improper Restriction of Excessive Authentication Attempts"}],"description":"Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path","id":"CVE-2026-102825","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"simple-git allows command execution through unblocked Git configuration includes","id":"CVE-2026-102826"},"packages":[{"ecosystem":"crates.io","fixed":["0.62.6"],"introduced":["0"],"last_affected":[],"package":"russh","purl":null,"source":"GHSA-g6xm-f9xp-qq35"},{"ecosystem":"crates.io","fixed":["0.62.6"],"introduced":["0"],"last_affected":[],"package":"russh","purl":"pkg:cargo/russh","source":"GHSA-g6xm-f9xp-qq35"}],"prev":{"headline":"Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange","id":"CVE-2026-102824"},"products":["russh"],"published":"2026-09-29","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-30","vendors":["Eugeny"]},"summary":"An unauthenticated remote attacker can bypass configured authentication attempt limits in the Russh SSH library, enabling brute-force attacks and increasing server workload.","url":"https://insights.sbomify.com/CVE-2026-102825/"}