Vulnerability RUSTSEC-2026-0496
Summary
Pre-authentication allocation from the keyboard-interactive response count
Details
A server that answers a keyboard-interactive authentication request with prompts (Auth::Partial, as a TOTP or other second-factor login does) then parses the client's SSH_MSG_USERAUTH_INFO_RESPONSE. russh read the number of responses from that message and reserved a vector of that many entries before reading any of them. A client that has not authenticated can send a very large count in a packet that carries no responses at all, and the server tries to allocate several gigabytes and may be killed for running out of memory.
Servers whose handler keeps the default behaviour, which rejects keyboard-interactive authentication, are not affected. From 0.60.1 the count is limited by how many responses the remaining packet data could actually hold.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
