Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-08 | 1 | Disclosure1 |
| 2026-05-09 | 1 | Patch1 |
CVE-2026-42189 Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive… https://www.cve.org/CVERecord?id=CVE-2026-42189
Post summary
A pre-authentication DoS flaw exists in the Rust SSH library Russh, fixed starting with version 0.60.1, with no discussion of active exploitation or PoC.
CVE-2026-42189 Pre-Authentication Denial-of-Service in Russh SSH Server Before 0.60.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42189
Post summary
The post announces a pre-authentication Denial-of-Service vulnerability in Russh SSH Server versions before 0.60.1, with no indication of PoC, exploit tools, or active exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | russh_project | russh | - | rust | - |
| App | warpgate_project | warpgate | - | - | - |