CVE-2026-42189
High
Description
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductRussh
PublishedMay 8, 2026
First seenMay 8, 2026
How to fix
Update
- russh_project russh0.60.1 or later
- warpgate_project warpgate0.23.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| russh_project russh | v < 0.60.1 | 0.60.1 |
| warpgate_project warpgate | v < 0.23.1 | 0.23.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.