russh SSH server accepts mismatched signature algorithm in publickey auth
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
russh, a Rust SSH client and server library, from version 0.34.0-beta.1 before 0.64.0 has an SSH server that does not check that the signature algorithm in a public-key authentication matches the algorithm named in the request (CWE-347). A client holding an authorized RSA private key can announce rsa-sha2-512 while supplying a valid ssh-rsa SHA-1 signature, which can bypass algorithm restrictions or produce misleading audit records. A valid private-key signature is still required, and russh clients are not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
russh is a Rust SSH client and server library. From version 0.34.0-beta.1 until version 0.64.0, its SSH server does not require the signature algorithm in a public-key authentication signature to match the algorithm named in the authentication request. A client possessing an authorized RSA private key can announce rsa-sha2-512 while supplying a valid ssh-rsa SHA-1 signature, bypassing restrictions or producing misleading audit records when applications rely on the requested algorithm. A valid private-key signature remains required, and russh clients are not affected. This issue is fixed in version 0.64.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eugeny | russh | 0.34.0-beta.1 to before 0.64.0 | 0.64.0 | Patch available | CNA |
| — | russh (crates.io) | 0.34.0-beta.1 to before 0.64.0 | 0.64.0 | Patch available | GHSA-j7h2-66j4-ghjf |
- russh VendorEugeny Affected 0.34.0-beta.1 to before 0.64.0 Fixed in 0.64.0 Patch available CNA
- russh (crates.io) Vendor— Affected 0.34.0-beta.1 to before 0.64.0 Fixed in 0.64.0 Patch available GHSA-j7h2-66j4-ghjf
Remediation
Update russh to version 0.64.0, which fixes the issue in both the Eugeny russh and crates.io russh packages.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA russh (Eugeny) Fixed in 0.64.0
- Fix · GHSA-j7h2-66j4-ghjf russh (crates.io) Fixed in 0.64.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-11-05 Threatist record created from CVE-2026-111062
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
- 2026-11-07 Affected versions changed · Red Hat
- 2026-11-07 CVSS score added · Red Hat
References
More Eugeny vulnerabilities
- TI-2026-65512 russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened CVSS 3.1HIGH 7.5
- TI-2026-35550 Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds CVSS 3.1HIGH 7.5
- TI-2026-34331 Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets CVSS 3.1HIGH 7.5
- TI-2026-34308 Resource allocation without limits in Eugeny russh CVSS 3.1HIGH 7.5
- TI-2025-16084 Tabby has a TCC Bypass via Misconfigured Node Fuses CVSS 4.0HIGH 8.6
- TI-2024-36991 Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby CVSS 4.0HIGH 8.6
Sources
- CVE-2026-111062 · CVE Program
- CVE-2026-111062 · NVD
- FIRST EPSS
- CVE-2026-111062 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences