CVE-2026-68930: Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in rus

mediumCVSS 6.5CVE-2026-68930

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.5
Published: 2026-08-03
Last updated: 2026-08-03
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-68930

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-68930	coverage & exploitation status	NVD · CVE.org

Recent advisories for Russh is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumGHSA-g9hv-x236-4qp3: Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)ghsa · 2026-07-24
mediumGHSA-cqjc-rmpq-xprq: Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsghsa · 2026-07-24
mediumGHSA-5xvq-cp9x-6p6r: Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)ghsa · 2026-07-24

CVE-2026-68930: Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in rus

Details

Referenced CVEs

Recent advisories for Russh is a

More from NVD Recent CVEs