CVE-2026-102825 in Russh
Summary
by MITRE • 09/29/2026
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within the Russh SSH library represents a critical failure in access control enforcement mechanisms for both client and server implementations written in Rust. Specifically, this flaw resides in the USERAUTH_REQUEST processing path located within the encrypted.rs module of the server component. The core technical deficiency is that while the system correctly increments an internal counter tracking authentication attempts via self.common.auth_attempts, it fails to perform a necessary comparison against the configured maximum allowed attempts defined by server::Config.max_auth_attempts. This logical omission means that the enforcement logic intended to restrict brute-force or credential stuffing attacks is effectively bypassed because the threshold check never triggers a termination of the connection session.
From an operational perspective, this defect allows unauthenticated remote actors to persistently submit authentication requests over a single established TCP connection without being disconnected after exceeding the administrator-defined limit. This directly undermines security policies designed to mitigate online password guessing and automated credential stuffing attacks. By allowing unlimited attempts on one connection, attackers can significantly increase their opportunity for successful unauthorized access through brute-force methods while simultaneously imposing an unnecessary load on backend authentication services due to the sustained volume of requests that should have been rejected earlier in the session lifecycle.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-307 Improvement of Authentication Bypass Using an Alternate Path or Channel, as it involves a failure to enforce proper access control limits during the authentication phase. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques related to Brute Force (T1110) by removing a key defensive barrier that would normally limit the rate and duration of guessing attempts. The lack of connection termination after exceeding thresholds also contributes to resource exhaustion scenarios where an attacker can maintain open connections indefinitely while performing repeated authentication trials.
The issue has been addressed in version 0.62.6 of the Russh library, which implements the missing comparison logic to ensure that auth_attempts are properly validated against max_auth_attempts before allowing further USERAUTH_REQUEST processing. Organizations utilizing this library must upgrade immediately to mitigate the risk of unauthorized access and service degradation resulting from unrestricted authentication attempts. Additionally, defense-in-depth strategies should be employed, including network-level rate limiting and intrusion detection systems capable of identifying persistent connection patterns indicative of brute-force activity, as these provide supplementary protection even if application-layer controls are delayed or misconfigured in other contexts.