https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T03:12:59.992313+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-102825 CVE-2026-102825 — Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path 2026-10-01T03:12:59.994089+00:00

Affected: Eugeny russh

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.