CVE-2026-48107

Name of the Vulnerable Software and Affected Versions russh versions 0.37.0 through 0.60.2

Description In the keyboard-interactive authentication path of the client, a malicious SSH server can send a USERAUTH INFO REQUEST containing an attacker-controlled prompt count. The client uses this raw count directly in the Vec::with capacity() function within the russh/src/client/encrypted.rs file before validating if the packet actually contains the corresponding amount of prompt data. This can lead to a client-side denial-of-service or resource exhaustion due to an attempt to allocate an excessive amount of memory.

Recommendations Update to version 0.61.0.