1 line
1.9 KiB
JSON
1 line
1.9 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0496","published":"2026-04-24T12:00:00Z","modified":"2026-11-12T08:00:04.107511355Z","aliases":["CVE-2026-42189","GHSA-f5v4-2wr6-hqmg"],"summary":"Pre-authentication allocation from the keyboard-interactive response count","details":"A server that answers a keyboard-interactive authentication request with prompts (`Auth::Partial`, as a TOTP or other second-factor login does) then parses the client's `SSH_MSG_USERAUTH_INFO_RESPONSE`. russh read the number of responses from that message and reserved a vector of that many entries before reading any of them. A client that has not authenticated can send a very large count in a packet that carries no responses at all, and the server tries to allocate several gigabytes and may be killed for running out of memory.\n\nServers whose handler keeps the default behaviour, which rejects keyboard-interactive authentication, are not affected. From 0.60.1 the count is limited by how many responses the remaining packet data could actually hold.","affected":[{"package":{"name":"russh","ecosystem":"crates.io","purl":"pkg:cargo/russh"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.60.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0496.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/russh"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0496.html"},{"type":"WEB","url":"https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} |