AIKIDO-2026-918588
russh is vulnerable to Improper Restriction of Excessive Authentication Attempts
37
Low Risk
This Affects:
russhTL;DR
The russh SSH server does not enforce the configured max_auth_attempts limit in the USERAUTH_REQUEST runtime path. The per-connection attempt counter is incremented but never compared against the configured cap, so a remote unauthenticated client can keep sending authentication requests on a single connection beyond the limit operators expect. This expands the online password-guessing window and increases authentication backend workload where deployers rely on this control. The fix enforces the cap in the auth-request branch and disconnects the client once the threshold is reached.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, you run the russh server and rely on Config.max_auth_attempts to cap authentication attempts.
Background info
russh is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.0.1 - 0.62.5.
How to fix this
Upgrade the russh library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant