CVE-2026-42189

{
  "id": "CVE-2026-42189",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T20:16:31.443",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1."
    },
    {
      "lang": "es",
      "value": "Russh es una biblioteca de cliente y servidor SSH de Rust. Antes de la versión 0.60.1, existe una vulnerabilidad de denegación de servicio de preautenticación en el gestor de autenticación interactiva por teclado del servidor. Un cliente malicioso puede bloquear cualquier servidor basado en Russh que implemente autenticación interactiva por teclado (p. ej., para 2FA/TOTP) con un único paquete malformado, sin requerir credenciales. Este problema ha sido parcheado en la versión 0.60.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Eugeny",
          "product": "russh",
          "versions": [
            {
              "version": "< 0.60.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T14:23:22.063007Z",
          "id": "CVE-2026-42189",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        },
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:russh_project:russh:*:*:*:*:*:rust:*:*",
              "versionEndExcluding": "0.60.1",
              "matchCriteriaId": "3B0C52D5-1F74-4959-9248-8CCE6309162E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.23.1",
              "matchCriteriaId": "449C9C44-332F-4C2C-A619-33C5025249DB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.60.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}