CVE-2026-111062

// ---- PoC: signature algorithm not checked against the requested one ----

/// Records whether `auth publickey` (called only after the signature
/// verified) was reached.
#[derive(Default)]
struct AcceptAnyKey {
  authenticated: bool,
}

impl Handler for AcceptAnyKey {
  type Error = Error;

  async fn auth publickey offered(
    &mut self,
     user: &str,
     public key: &PublicKey,
  ) -> Result<Auth, Self::Error> {
    Ok(Auth::Accept)
  }

  async fn auth publickey(
    &mut self,
     user: &str,
     public key: &PublicKey,
  ) -> Result<Auth, Self::Error> {
    self.authenticated = true;
    Ok(Auth::Accept)
  }
}

/// A signed publickey request that names `announced` as its public key
/// algorithm, but is signed with `hash` (`None` = `ssh-rsa`, SHA-1).
fn signed request announcing(
  user: &str,
  private key: Arc<PrivateKey>,
  announced: &str,
  hash: Option<crate::keys::HashAlg>,
) -> Vec<u8> {
  let mut packet = Vec::new();
  packet.push(msg::USERAUTH REQUEST);
  user.encode(&mut packet).unwrap();
  "ssh-connection".encode(&mut packet).unwrap();
  "publickey".encode(&mut packet).unwrap();
  1u8.encode(&mut packet).unwrap();
  announced.encode(&mut packet).unwrap();
  private key.public key().to bytes().unwrap().encode(&mut packet).unwrap();

  let mut signed = Vec::new();
  CryptoVec::new().as ref().encode(&mut signed).unwrap();
  signed.extend from slice(&packet);
  let signature =
    sign with hash alg(&PrivateKeyWithHashAlg::new(private key, hash), &signed).unwrap();
  signature.encode(&mut packet).unwrap();
  packet
}

#[tokio::test]
async fn poc sha1 signature accepted when rsa sha2 512 is announced() {
  let rsa = ssh key::private::RsaKeypair::random(&mut rand::rng(), 2048).unwrap();
  let private = Arc::new(PrivateKey::from(rsa));
  let mut session = test auth session();
  let mut handler = AcceptAnyKey::default();

  // The request says rsa-sha2-512; the signature blob is ssh-rsa (SHA-1).
  let packet = signed request announcing("alice", private, "rsa-sha2-512", None);
  session.process packet(&mut handler, &packet).await.unwrap();

  // RFC 8332 §3: the signature algorithm must be the requested one, so
  // this request must be rejected. On russh 0.63.3 it is accepted.
  assert!(
    !handler.authenticated,
    "an ssh-rsa (SHA-1) signature was accepted for a request announcing rsa-sha2-512"
  );
}

test server::encrypted::tests::poc sha1 signature accepted when rsa sha2 512 is announced ... FAILED
panicked at src/server/encrypted.rs: an ssh-rsa (SHA-1) signature was accepted for a request announcing rsa-sha2-512

--- a/russh/src/server/encrypted.rs
+++ b/russh/src/server/encrypted.rs
@@ -1023,6 +1023,21 @@
           map err!(ensure end(&signature reader))?;
           map err!(ensure end(r))?;
 
+          // RFC 8332 §3: the signature must use the algorithm the
+          // request names.
+          let offered algorithm = match pk or cert {
+            PublicKeyOrCertificate::PublicKey { .. } => ssh key::Algorithm::new(&pubkey algo),
+            PublicKeyOrCertificate::Certificate( ) => {
+              <ssh key::Algorithm as crate::helpers::AlgorithmExt>::new certificate ext(&pubkey algo)
+            }
+          };
+          if offered algorithm.ok().as ref() != Some(&sig.algorithm()) {
+            debug!("signature algorithm does not match the requested one");
+            auth user.clear();
+            reject auth request(until, &mut self.write, auth request).await?;
+            return Ok(());
+          }
+
           let is valid = if accepted probe matches && user == auth user {
             true
           } else {