{"id":"EUVD-2026-89205","enisaUuid":"dad90ce2-8be1-3895-8db6-0ee8fdce2e58","description":"Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac\u003dnone can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, causing russh/src/cipher/mod.rs to shrink the previously read block before indexing buffer.buffer[16..], which panics and terminates the connection task. This issue is fixed in version 0.63.1.","datePublished":"Sep 29, 2026, 6:23:28 PM","dateUpdated":"Sep 29, 2026, 7:53:30 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-p8qx-h547-fjw9\nhttps://github.com/Eugeny/russh/commit/2885385abfee279092a41d80c6cb6ac367353159\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\n","aliases":"CVE-2026-102822\nGHSA-p8qx-h547-fjw9\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"acfbf69e-1212-3f8b-a46e-9db8e3c55c0c","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"\u003c 0.63.1"}],"enisaIdVendor":[{"id":"6d5e29f8-5a9f-38f5-adee-b5999caec81f","vendor":{"name":"Eugeny"}}],"enisaIdVulnerability":[{"id":"ef33460c-fbc0-31d8-b80f-0da81daee35d","vulnerability":{"id":"CVE-2026-102822","description":"Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac\u003dnone can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, causing russh/src/cipher/mod.rs to shrink the previously read block before indexing buffer.buffer[16..], which panics and terminates the connection task. This issue is fixed in version 0.63.1.","datePublished":"Sep 29, 2026, 6:23:28 PM","dateUpdated":"Sep 29, 2026, 7:53:30 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-p8qx-h547-fjw9\nhttps://github.com/Eugeny/russh/commit/2885385abfee279092a41d80c6cb6ac367353159\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\n","enisa_id":"EUVD-2026-89205\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 11, 2026, 7:20:40 AM","vulnerabilityProduct":[{"id":"052b0732-4baa-3086-ab82-3f6f23227ad8","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"\u003c 0.63.1"}],"vulnerabilityVendor":[{"id":"0b3bec32-0e5d-3026-8d06-8baf0e23d033","vendor":{"name":"Eugeny"}}]}},{"id":"f3e62049-d23b-30d0-9dae-7ee2704a9f8d","vulnerability":{"id":"GHSA-p8qx-h547-fjw9","description":"russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac\u003dnone causes a slice-index-out-of-range panic","datePublished":"Sep 30, 2026, 11:27:30 PM","dateUpdated":"Sep 30, 2026, 11:27:30 PM","baseScore":0.0,"references":"https://github.com/Eugeny/russh/security/advisories/GHSA-p8qx-h547-fjw9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102822\nhttps://github.com/Eugeny/russh/commit/2885385abfee279092a41d80c6cb6ac367353159\nhttps://github.com/Eugeny/russh\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\n","enisa_id":"EUVD-2026-89205\n","aliases":"GHSA-p8qx-h547-fjw9\nCVE-2026-102822\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}