« Volver al listado

CVE-2026-46705

Estado: AplazadaMedia (5.3)—

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Russh — RusshAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-46705",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46705",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-11T14:13:43.639627Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Eugeny",
          "product": "russh",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.34.0-beta.1, < 0.61.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-10T22:17:00.713",
  "references": [
    {
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0."
    },
    {
      "lang": "es",
      "value": "Russh es una biblioteca SSH cliente y servidor de Rust. Desde la versión 0.34.0-beta.1 hasta antes de la versión 0.61.0, la ruta de autenticación del servidor russh mantiene el estado interno de userauth a través de los mensajes SSH_MSG_USERAUTH_REQUEST sin separar ese estado cuando el principal de la solicitud cambia. RFC 4252 permite que los campos de nombre de usuario y nombre de servicio cambien entre solicitudes de autenticación. El problema no es que dichos cambios sean inválidos. El problema es que el estado de autenticación propiedad de russh, como los métodos restantes, el estado de éxito parcial y el estado del método en curso, puede permanecer asociado con la conexión y luego influir en una solicitud posterior para un (usuario, servicio) diferente. Esto es una inconsistencia de estado interno de la biblioteca. Este problema ha sido parcheado en la versión 0.61.0."
    }
  ],
  "lastModified": "2026-07-23T09:10:00.113",
  "sourceIdentifier": "security-advisories@github.com"
}