Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
### Details #### Affected versions and vulnerable location - Confirmed present on default branch `main` at HEAD `0089c89c94753bebbec12b956c07a1cd38740379`. - Crate version at HEAD: `0.62.4`. - Vulnerable locations on current default branch: - `russh/src/server/mod.rs:91` (`pub max_auth_attempts: usize`) - `russh/src/server/mod.rs:121` (default `max_auth_attempts: 10`) - `russh/src/server/encrypted.rs:89` (`USERAUTH_REQUEST` dispatch into auth handler path) - `russh/src/server/encrypted.rs:98` (`self.common.auth_attempts += 1`) - `russh/src/server/encrypted.rs:53` (only runtime read of `auth_attempts`, used for initial reject timing, not attempt limiting) - Default-branch history check did not show a newer merged commit adding enforcement against `config.max_auth_attempts`. #### Reachability trace verified 1. Entry point: exported server API `server::run_stream` in `russh/src/server/mod.rs:1049`. 2. Session run loop in `russh/src/server/session.rs` processes incoming packets and calls `reply(...)` (`server/session.rs:725`). 3. `reply` forwards encrypted packets to `session.server_read_encrypted(...)` (`server/mod.rs:1221`). 4. `server_read_encrypted` routes `USERAUTH_REQUEST` to `enc.server_read_auth_request(...)` (`server/encrypted.rs:89`). 5. On each request, `self.common.auth_attempts += 1` executes (`server/encrypted.rs:98`). 6. No comparison against `self.common.config.max_auth_attempts` is present in this runtime flow. ### PoC #### Reproduction steps and observed output
GHSA-g6xm-f9xp-qq35
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-g6xm-f9xp-qq35
russh
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.62.6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.6"
}
]
}
],
"package": {
"name": "russh",
"purl": "pkg:cargo/russh",
"ecosystem": "crates.io"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g6xm-f9xp-qq35/GHSA-g6xm-f9xp-qq35.json",
"last_known_affected_version_range": "<= 0.62.5"
}
}
]- Related CVEs
- CVE-2026-102825
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #51901 · Revision 1
- Added to Heist Feed
- Publisher date