CVE-2026-102822

LowCVSS 3.7/10Last modified Sep 29, 2026

Description

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, causing russh/src/cipher/mod.rs to shrink the previously read block before indexing buffer.buffer[16..], which panics and terminates the connection task. This issue is fixed in version 0.63.1.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-129

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1028237.5Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_CVE-2026-1028244.3Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkeCVE-2026-1028253.7Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/serveCVE-2026-1028268.1simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScriptCVE-2026-1028279.8simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScriptCVE-2026-1028289.8simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScriptCVE-2026-1028299.2simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScriptCVE-2026-102836.3A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. PerformiCVE-2026-1028306.8JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterCVE-2026-1028318.1JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterCVE-2026-1028324.2JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 uCVE-2026-1028347.5JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit bu