Eugeny vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20252
3. 202630

Newest CVEs

• CVE-2026-111062

  A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request

  Eugeny · russh

  Low2.3
• CVE-2026-116794

  russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

  Eugeny · russh

  High8.3
• CVE-2026-116775

  pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

  Eugeny · russh

  Low2.3
• CVE-2026-116774

  russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

  Eugeny · russh

  Medium4.3
• CVE-2026-116773

  russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

  Eugeny · russh

  Medium4.3
• CVE-2026-116696

  russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

  Eugeny · russh

  Low3.3
• CVE-2026-111061

  russh agent server converts constraint records into unbounded never-rolled-back tasks

  Eugeny · russh

  Medium4.3
• CVE-2026-102825

  Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

  Eugeny · russh

  Low3.7
• CVE-2026-102824

  Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

  Eugeny · russh

  Medium4.3
• CVE-2026-102823

  russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

  Eugeny · russh

  High7.5