https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:33:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343763 EUVD-2026-343763 https://cve.radiocsirt.org/vuln/euvd-2026-343763 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68930 <p>Russh is a Rust SSH client &amp; server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.</p> <p>Russh is a Rust SSH client &amp; server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68930 https://cve.radiocsirt.org/vuln/ghsa-m65r-rprj-r5rg <p><strong>Affected:</strong> crates.io: russh</p> <p>There is a server-side channel state issue in `russh`.</p> <p>After a client is authenticated, `russh` can dispatch channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. In the strongest reproduced case, the client does not send `SSH_MSG_CHANNEL_OPEN` at all. It authenticates normally, then sends `SSH_MSG_CHANNEL_REQUEST` packets with request type `exec` for a range of recipient channel IDs. `russh` still calls the server application&#39;s `exec_request` handler.</p> <p>This is not an authentication bypass. A valid login is required. The issue is that the SSH channel lifecycle is not enforced before channel-scoped callbacks are delivered to the application.</p> <p>## Impact</p> <p>An authenticated client can bypass the server application&#39;s channel-open policy.</p> <p>A server may deny session channels by returning `false` from `Handler::channel_open_session`. A server may also assume that callbacks such as `exec_request`, `shell_request`, `subsystem_request`, `data`, `channel_eof`, or `channel_close` are only delivered for channels that were opened and confirmed by the SSH transport layer.</p> <p>That assumption does not hold in the vulnerable path. A malicious authenticated peer can send channel-scoped messages for arbitrary recipient channel IDs and cause handler callbacks to run even though no channel exists.</p> <p>The exact impact depends on the downstream application. For many SSH server use cases, `exec_request`, `shell_request`, or `subsystem_request` start commands, job…</p> <p><strong>Affected:</strong> crates.io: russh</p> <p>There is a server-side channel state issue in `russh`.</p> <p>After a client is authenticated, `russh` can dispatch channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. In the strongest reproduced case, the client does not send `SSH_MSG_CHANNEL_OPEN` at all. It authenticates normally, then sends `SSH_MSG_CHANNEL_REQUEST` packets with request type `exec` for a range of recipient channel IDs. `russh` still calls the server application&#39;s `exec_request` handler.</p> <p>This is not an authentication bypass. A valid login is required. The issue is that the SSH channel lifecycle is not enforced before channel-scoped callbacks are delivered to the application.</p> <p>## Impact</p> <p>An authenticated client can bypass the server application&#39;s channel-open policy.</p> <p>A server may deny session channels by returning `false` from `Handler::channel_open_session`. A server may also assume that callbacks such as `exec_request`, `shell_request`, `subsystem_request`, `data`, `channel_eof`, or `channel_close` are only delivered for channels that were opened and confirmed by the SSH transport layer.</p> <p>That assumption does not hold in the vulnerable path. A malicious authenticated peer can send channel-scoped messages for arbitrary recipient channel IDs and cause handler callbacks to run even though no channel exists.</p> <p>The exact impact depends on the downstream application. For many SSH server use cases, `exec_request`, `shell_request`, or `subsystem_request` start commands, job…</p> https://cve.radiocsirt.org/vuln/ghsa-m65r-rprj-r5rg