{"id":"EUVD-2026-117796","enisaUuid":"c693bb30-ca07-313b-8e1e-70f529c4d1d6","description":"russh is a Rust SSH client and server library. From version 0.34.0-beta.1 until version 0.64.0, its SSH server does not require the signature algorithm in a public-key authentication signature to match the algorithm named in the authentication request. A client possessing an authorized RSA private key can announce  rsa-sha2-512  while supplying a valid  ssh-rsa  SHA-1 signature, bypassing restrictions or producing misleading audit records when applications rely on the requested algorithm. A valid private-key signature remains required, and russh clients are not affected. This issue is fixed in version 0.64.0.","datePublished":"Nov 5, 2026, 8:47:35 PM","dateUpdated":"Nov 5, 2026, 9:15:12 PM","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-j7h2-66j4-ghjf\nhttps://github.com/Eugeny/russh/pull/759\nhttps://github.com/Eugeny/russh/commit/a0ded76bdc352f8fbeaaeb175fb2a0c586fbc8f2\nhttps://github.com/Eugeny/russh/releases/tag/v0.64.0\n","aliases":"CVE-2026-111062\nGHSA-j7h2-66j4-ghjf\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"2b921a73-6f17-3fec-a643-530f9bd1c2fe","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"0.34.0-beta.1, \u003c 0.64.0"}],"enisaIdVendor":[{"id":"898dbf7e-26de-3d82-bba2-cd36e2b86f8b","vendor":{"name":"Eugeny"}}],"enisaIdVulnerability":[{"id":"5fbda756-8234-389b-acaa-62aa71c04cc7","vulnerability":{"id":"GHSA-j7h2-66j4-ghjf","description":"A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request","datePublished":"Oct 19, 2026, 5:06:29 PM","dateUpdated":"Oct 19, 2026, 5:06:29 PM","baseScore":0.0,"references":"https://github.com/Eugeny/russh/security/advisories/GHSA-j7h2-66j4-ghjf\nhttps://github.com/Eugeny/russh/commit/a0ded76bdc352f8fbeaaeb175fb2a0c586fbc8f2\nhttps://github.com/Eugeny/russh\nhttps://github.com/Eugeny/russh/releases/tag/v0.64.0\n","enisa_id":"EUVD-2026-117796\n","aliases":"GHSA-j7h2-66j4-ghjf\nCVE-2026-111062\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d9180977-e07e-3c54-be76-3d601c135d6d","vulnerability":{"id":"CVE-2026-111062","description":"russh is a Rust SSH client and server library. From version 0.34.0-beta.1 until version 0.64.0, its SSH server does not require the signature algorithm in a public-key authentication signature to match the algorithm named in the authentication request. A client possessing an authorized RSA private key can announce  rsa-sha2-512  while supplying a valid  ssh-rsa  SHA-1 signature, bypassing restrictions or producing misleading audit records when applications rely on the requested algorithm. A valid private-key signature remains required, and russh clients are not affected. This issue is fixed in version 0.64.0.","datePublished":"Nov 5, 2026, 8:47:35 PM","dateUpdated":"Nov 5, 2026, 9:15:12 PM","status":"PUBLISHED","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-j7h2-66j4-ghjf\nhttps://github.com/Eugeny/russh/pull/759\nhttps://github.com/Eugeny/russh/commit/a0ded76bdc352f8fbeaaeb175fb2a0c586fbc8f2\nhttps://github.com/Eugeny/russh/releases/tag/v0.64.0\n","enisa_id":"EUVD-2026-117796\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Nov 7, 2026, 6:00:38 AM","vulnerabilityProduct":[{"id":"08385b9e-33af-3ee0-b273-edcc35b4532c","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"0.34.0-beta.1, \u003c 0.64.0"}],"vulnerabilityVendor":[{"id":"25cc03c3-eeb6-3413-9aa3-936e2728cba0","vendor":{"name":"Eugeny"}}]}}],"enisaIdAdvisory":[]}