CVE-2026-102825: Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

September 30, 2026

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

References

github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653
github.com/Eugeny/russh/releases/tag/v0.62.6
github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35
github.com/advisories/GHSA-g6xm-f9xp-qq35
nvd.nist.gov/vuln/detail/CVE-2026-102825

Code Behaviors & Features

Detect and mitigate CVE-2026-102825 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →