CVE-2026-102823: russh Client-Side Handler Callback Vulnerability Allows Spoofed Channel Events
Summary
CVE-2026-102823: russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened. Affects russh versions < 0.63.1. Fixed in 0.63.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
russh is an open-source Rust library that provides SSH client and server functionalities. It is designed to facilitate secure communication over unsecured networks by implementing the SSH protocol. The library is widely used in deployment tools, CI runners, and other automation tasks that require SSH connections. However, a vulnerability exists that allows malicious servers to send spoofed channel events to clients, potentially leading to application integrity violations.
Vulnerability Detail
The vulnerability arises from the lack of validation on the client side of the russh library, specifically in the handling of channel-scoped messages. While the server-side was fixed to ensure that only established channels trigger callbacks, the client-side still processes messages for channel IDs that the client never opened. This oversight allows a malicious SSH server to predict channel IDs and send spoofed lifecycle events, leading to potential denial of service (DoS) or desynchronization of command completion bookkeeping. The vulnerability is classified under CWE-20: Improper Input Validation.
How To Fix
Latest published version: 0.64.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.63.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application implements additional checks to validate channel IDs before processing any channel-scoped messages. This can help mitigate the risk of spoofed events until the library is updated. For example:
if self.channels.contains_key(&channel_num) {
// Process the message
} else {
// Ignore or handle the unknown channel ID
}
Conclusion
The CVE-2026-102823 vulnerability in the russh library poses significant risks to applications relying on SSH communications. By updating to version 0.63.1 or later, developers can mitigate these risks and ensure their applications handle channel events securely. Additionally, implementing temporary workarounds can provide further protection until the update is applied.
See every vulnerability recorded for russh →
FAQ
CVE-2026-102823 is a vulnerability in the russh library that allows malicious SSH servers to send spoofed channel events to clients, potentially leading to application integrity violations.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot update the package, implement additional validation checks in your application to ensure that only known channel IDs are processed.
You can find more information about the russh library on its GitHub repository or its documentation page.
References
Related vulnerabilities
Recent vulnerabilities recorded for russh.
