CVE-2026-68930: eugeny russh
CVSS: 6.5v3.1MediumDeferred
AliasesCGA-98mv-x4fc-rgchCGA-hrwc-qrgv-8m73GHSA-m65r-rprj-r5rgDEBIAN-CVE-2026-68930
Published 03-08-2026Last modified 03-08-2026
Vulnerability summary
CVE-2026-68930 is a medium (CVSS 6.5) vulnerability in eugeny russh. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.1% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.38%
0%100%
Low · +0.12 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 03-08-2026Last modifiedVulnerability information updated.
Description
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesAll 6 agree
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · Crates.ioEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
+0.12 pp
From 0.26% on 20-09-2026
20-09-202620-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-666Operation on Resource in Wrong Phase of LifetimeThe product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
- CWE-696Incorrect Behavior OrderThe product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Chainguard1 product
- yazi< 26.5.6-r7
Crates.Io1 product
- russh< 0.62.5
Debian1 product
- rust-russh< 0.64.1-1
Eugeny1 product
- russh< 0.62.5
Wolfi1 product
- yazi< 26.5.6-r7
5 vendors · 5 products
References
7 links
- github.com/Eugeny/russhPACKAGE
