Eugeny Russh up to 0.62.5 Authentication Attempt Limiter encrypted.rs server::run_stream comparison

Summaryinfo

A vulnerability described as problematic has been identified in Eugeny Russh up to 0.62.5. The impacted element is the function server::run_stream of the file russh/src/server/encrypted.rs of the component Authentication Attempt Limiter. Executing a manipulation can lead to comparison. This vulnerability is tracked as CVE-2026-102825. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Eugeny Russh up to 0.62.5 and classified as problematic. This vulnerability affects the function server::run_stream of the file russh/src/server/encrypted.rs of the component Authentication Attempt Limiter. The manipulation with an unknown input leads to a comparison vulnerability. The CWE definition for the vulnerability is CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. As an impact it is known to affect confidentiality. CVE summarizes:

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.

The advisory is available at github.com. This vulnerability was named CVE-2026-102825 since 09/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 0.62.6 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Eugeny

Name

• Russh

Version

• 0.62.0
• 0.62.1
• 0.62.2
• 0.62.3
• 0.62.4
• 0.62.5

Website

• Product: https://github.com/Eugeny/russh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion