Skip to content
Heist/ feed
Back to feed
Medium

Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

Type: advisorySources: OSV

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-48108
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:27 UTC · Revision 1

Source evidence

Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

core-osv · Original source

Published 10 Jun 2026, 20:24 UTC

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0.

osv:CVE-2026-48108
Complete source record
{
  "id": "78324c8154316cbc61f1540a90f9fb6cb3953a3ddc50eaf9e49c1fd5dcbccc25",
  "url": "https://osv.dev/vulnerability/CVE-2026-48108",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input",
    "summary": "Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0.",
    "evidence": "osv:CVE-2026-48108",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-48108",
      "aliases": [
        "CVE-2026-48108",
        "GHSA-76r6-x97p-67vr"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/eugeny/russh",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1947d6b1bb3a9d79840b5adf7eb9b33df2c6e4a7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.34.0-beta.1"
                      },
                      {
                        "fixed": "0.61.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.61.0"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.60.3",
            "v0.60.2",
            "v0.60.1",
            "v0.60.0",
            "v0.59.0",
            "v0.58.0",
            "v0.57.1",
            "v0.57.0",
            "v0.56.0",
            "v0.55.0",
            "v0.54.6",
            "v0.54.5",
            "v0.54.4",
            "v0.54.3",
            "v0.54.2",
            "v0.54.1",
            "v0.54.0",
            "v0.53.0",
            "v0.53.0-beta.1",
            "v0.52.1",
            "v0.52.0",
            "v0.52.0-beta.1",
            "v0.51.1",
            "v0.51.0",
            "v0.51.0-beta.3",
            "v0.51.0-beta.2",
            "v0.51.0-beta.1",
            "v0.50.4",
            "v0.50.3",
            "v0.50.1",
            "v0.50.0",
            "v0.50.0-beta.12",
            "v0.50.0-beta.11",
            "v0.50.0-beta.10",
            "v0.50.0-beta.9",
            "v0.50.0-beta.8",
            "v0.50.0-beta.7",
            "v0.50.0-beta.6",
            "v0.50.0-beta.5",
            "v0.50.0-beta.4",
            "v0.50.0-beta.3",
            "v0.50.0-beta.2",
            "v0.49.0",
            "v0.48.2",
            "v0.48.1",
            "v0.48.0",
            "v0.47.0-beta.4",
            "v0.47.0-beta.3",
            "v0.46.0",
            "v0.45.0",
            "v0.44.0",
            "v0.44.0-beta.4",
            "v0.44.0-beta.3",
            "v0.44.0-beta.1",
            "v0.43.0",
            "v0.43.0-beta.1",
            "v0.42.0",
            "v0.40.2",
            "v0.40.1",
            "v0.40.0",
            "v0.38.0",
            "v0.39.0-beta.1",
            "v0.38.0-beta.1",
            "v0.37.1",
            "v0.37.0",
            "v0.36.1",
            "v0.37.0-beta.1",
            "0.37.0-beta.1",
            "v0.35.0-beta.9",
            "v0.35.0-beta.8",
            "v0.35.0-beta.7",
            "v0.35.0-beta.6",
            "v0.35.0-beta.5",
            "v0.35.0-beta.3",
            "v0.35.0-beta.2",
            "v0.35.0-beta.1",
            "v0.34.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48108.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.810759308Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48108.json",
        "https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-48108"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-20"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48108.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-48108",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500024,
  "published_at": "2026-06-10T20:24:56.666+00:00"
}