CVE-2026-102825: Russh Package Authentication Attempt Limit Bypass Vulnerability
Summary
CVE-2026-102825: Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path. Affects russh versions < 0.62.6. Fixed in 0.62.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Russh is an open-source SSH server implementation in Rust, designed to provide secure remote access to systems. It features various authentication methods and is widely used for its performance and safety. However, a vulnerability has been identified that allows attackers to bypass the configured limit on authentication attempts, potentially leading to unauthorized access through brute-force attacks.
Vulnerability Detail
The vulnerability arises from the failure to enforce the configured maximum number of authentication attempts in the USERAUTH_REQUEST runtime path. Specifically, the code does not compare the current number of authentication attempts against the configured limit, allowing an attacker to repeatedly send authentication requests without restriction. This oversight can lead to increased backend authentication workload and a higher risk of successful unauthorized access through brute-force methods.
How To Fix
Latest published version: 0.64.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.62.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a manual check in your authentication handling code to limit the number of attempts. For example, add the following code snippet before processing authentication requests:
if self.common.config.max_auth_attempts > 0 && self.common.auth_attempts >= self.common.config.max_auth_attempts
{
self.common.disconnect(
Disconnect::NoMoreAuthMethodsAvailable,
"Too many authentication attempts",
"",
)?;
return Ok(());
}
Conclusion
The Russh package has a vulnerability (CVE-2026-102825) that allows attackers to bypass authentication attempt limits. It is crucial to update to version 0.62.6 or later to mitigate this risk. Implementing the provided workaround can help secure your application until the update is applied.
See every vulnerability recorded for russh →
FAQ
CVE-2026-102825 is a vulnerability in the Russh package that allows attackers to bypass the configured limit on authentication attempts, increasing the risk of unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
Implement the provided workaround to limit authentication attempts manually until you can update to the patched version.
You can find more information about Russh on its GitHub repository and documentation, which provide insights into its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for russh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
