{"id":"EUVD-2026-89206","enisaUuid":"ba154969-ee48-3a4b-9dcf-0119c81187a1","description":"Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.","datePublished":"Sep 29, 2026, 6:25:58 PM","dateUpdated":"Oct 2, 2026, 12:20:10 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm\nhttps://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\n","aliases":"CVE-2026-102823\nGHSA-47hw-gvq5-r2gm\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"60b55a46-4b5a-3d3c-a89a-94d3b0015083","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"\u003c 0.63.1"}],"enisaIdVendor":[{"id":"03aae9b5-5169-3240-8eb6-9779a849333c","vendor":{"name":"Eugeny"}}],"enisaIdVulnerability":[{"id":"1765752f-70e0-371f-b6a6-c7e5f8cb1bf2","vulnerability":{"id":"CVE-2026-102823","description":"Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.","datePublished":"Sep 29, 2026, 6:25:58 PM","dateUpdated":"Oct 2, 2026, 12:20:10 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm\nhttps://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\n","enisa_id":"EUVD-2026-89206\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 2, 2026, 7:16:00 AM","vulnerabilityProduct":[{"id":"47c39c41-06a1-3fdf-a3b6-50fbac0ec48d","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"\u003c 0.63.1"}],"vulnerabilityVendor":[{"id":"12ee4a29-bc99-34df-b3d2-fa3c705acb67","vendor":{"name":"Eugeny"}}]}},{"id":"1cace17a-1620-31e8-9834-9a96ee61a0ca","vulnerability":{"id":"GHSA-47hw-gvq5-r2gm","description":"russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened","datePublished":"Sep 30, 2026, 11:27:17 PM","dateUpdated":"Sep 30, 2026, 11:27:17 PM","baseScore":0.0,"references":"https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102823\nhttps://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774\nhttps://github.com/Eugeny/russh\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.1\n","enisa_id":"EUVD-2026-89206\n","aliases":"GHSA-47hw-gvq5-r2gm\nCVE-2026-102823\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"d31717b8-c75e-37e3-862f-d45dc285c2ac","advisory":{"id":"RHSA-2026:74586","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 1, 2026, 5:20:02 PM","dateUpdated":"Oct 2, 2026, 10:21:21 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74586\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74586.json\n","aliases":"CVE-2026-102821\nCVE-2026-102823\nCVE-2026-102824\nCVE-2026-102825\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"1d213965-6349-3928-901f-c324c3cdf105","product":{"name":"openshell-0:0.1.2-0.2.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"1da60229-742d-300e-8551-abc8358a6d58","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"4b48be98-de6f-3d88-a8c9-e52f16349375","product":{"name":"openshell-0:0.1.2-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"9cba60dd-0f72-34f0-8b1b-c998c136f5c0","product":{"name":"python3-openshell-0:0.1.2-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"a88ee0f1-2f1b-3694-bf40-ee2ce61d5fdc","product":{"name":"openshell-gateway-0:0.1.2-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"b9f50e54-c055-3fd0-8a3b-de5cea3291a8","product":{"name":"openshell-gateway-0:0.1.2-0.2.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"c4a8ddd2-391b-31e5-bced-3f6dac6a1d08","product":{"name":"python3-openshell-0:0.1.2-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"f6c1b7e8-4cac-377e-9cf4-c0f63ae1a6f4","product":{"name":"openshell-0:0.1.2-0.2.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}