Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Eugeny
Russh

Eugeny/russh: Functions Patched by CVE Fixes

rust

#457 of 500 repositories

Eugeny/russh

Functions and files changed by CVE fixes in this repository.

Latest located fix September 29, 2026

13

CVE fixes located

Published CVEs

30

Functions patched

Distinct function sites

15

Files patched

Distinct source files

2024–2026

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in Eugeny/russh, the earliest published in 2024. Those fixes changed 30 distinct functions across 15 files, in 136 patch hunks.

Among the 500 repositories tracked here, Eugeny/russh ranks #457 by the number of CVEs with a located fix.

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References

Most patched functions

Functions in Eugeny/russh changed by the most CVE fixes.

1is_established_channelrussh/src/server/encrypted.rs2 CVEs · 2 patches2026
2encode_mpint_all_zero_is_empty_mpintrussh/src/kex/mod.rs2 CVEs · 1 patches2026
3compute_shared_secretrussh/src/kex/curve25519.rs2 CVEs · 1 patches2026
4process_packetrussh/src/server/encrypted.rs1 CVEs · 1 patches2026
5auth_attempts_capped_at_maxrussh/src/server/encrypted.rs1 CVEs · 1 patches2026
6server_handle_channel_openrussh/src/server/encrypted.rs1 CVEs · 1 patches2026
7kex_ecdh_initrussh/src/kex/curve25519.rs1 CVEs · 1 patches2026
8as_refrussh/src/session.rs1 CVEs · 1 patches2026
9Somerussh/src/client/encrypted.rs1 CVEs · 1 patches2026
10selectrussh/src/negotiation.rs1 CVEs · 1 patches2026
11needs_mac_cipher_rejects_negotiated_none_macrussh/src/negotiation.rs1 CVEs · 1 patches2026
12peer_kexinit_receivedrussh/src/client/kex.rs1 CVEs · 1 patches2026
13replyrussh/src/server/mod.rs1 CVEs · 1 patches2026
14peer_kexinit_receivedrussh/src/server/kex.rs1 CVEs · 1 patches2026
15replyrussh/src/client/mod.rs1 CVEs · 1 patches2026

Most patched files

Files in Eugeny/russh changed by the most CVE fixes.

1russh/src/server/encrypted.rs6 CVEs · 8 functions
2russh/src/kex/curve25519.rs3 CVEs · 4 functions
3russh/src/client/encrypted.rs2 CVEs · 2 functions
4russh/src/kex/mod.rs2 CVEs · 1 functions
5russh/src/cipher/mod.rs2 CVEs · 0 functions
6pageant/src/wmmessage.rs1 CVEs · 3 functions
7russh/src/client/mod.rs1 CVEs · 2 functions
8russh/src/kex/hybrid_mlkem.rs1 CVEs · 2 functions
9russh/src/negotiation.rs1 CVEs · 2 functions
10russh/src/client/kex.rs1 CVEs · 1 functions

Fix size

How much code a CVE fix in Eugeny/russh changes, with backports counted once.

32

Median lines changed

Added plus removed, per CVE

38%

Fixes of 20 lines or fewer

Share of CVE fixes

15%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in Eugeny/russh, and the functions each fix changed.

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
CVE-2026-102825auth_attempts_capped_at_max Session process_packet
Low · CVSS 3.7
EPSS 0.3%2026-09-29
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
CVE-2026-102824kex_ecdh_init KexAlgorithmImplementor Curve25519Kex
Medium · CVSS 4.3
EPSS 0.1%2026-09-29
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
CVE-2026-102823Session is_established_channel as_ref
High · CVSS 7.5
EPSS 0.3%2026-09-29
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
CVE-2026-102822needs_mac_cipher_rejects_negotiated_none_mac select
Low · CVSS 3.7
EPSS 0.3%2026-09-29
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
CVE-2026-102821reply peer_kexinit_received begin_rekey
Medium · CVSS 6.5
EPSS 0.3%2026-09-29
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
CVE-2026-102820read query_pageant_direct MemoryMap
Medium · CVSS 6.2
EPSS 0.1%2026-09-29
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
CVE-2026-73489Session
Medium · CVSS 4.3
EPSS 0.5%2026-08-13
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
CVE-2026-73430encode_mpint_all_zero_is_empty_mpint compute_shared_secret KexAlgorithmImplementor
Medium · CVSS 5.3
EPSS 0.6%2026-08-12
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
CVE-2026-73429encode_mpint_all_zero_is_empty_mpint compute_shared_secret KexAlgorithmImplementor
Medium · CVSS 5.3
EPSS 0.5%2026-08-12
Russh: Channel-scoped server callbacks can be reached without an open channel
CVE-2026-68930channel_request_for_unconfirmed_server_open_does_not_call_handler is_established_channel get_mut
Medium · CVSS 6.5
EPSS 0.4%2026-08-03
Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth
CVE-2026-42189read_userauth_info_response
High · CVSS 7.5
EPSS 0.8%2026-05-08
Russh is missing an overflow check during channel windows adjust
CVE-2025-54804Session
Medium · CVSS 6.5
EPSS 0.4%2025-08-05

Get an alert for each new Eugeny/russh CVE, with the patched functions and AI-written analysis.

Monitor russh CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs caddyserver/caddy13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs craftcms/commerce13 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in Eugeny/russh.

How many CVEs have a located fix in Eugeny/russh?: 13 published CVEs have a fix traced to functions in Eugeny/russh, touching 30 functions across 15 files.
Which function in Eugeny/russh has been patched by the most CVEs?: is_established_channel in russh/src/server/encrypted.rs has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in Eugeny/russh?: The median fix changes 32 lines. 38% of fixes change 20 lines or fewer, and 15% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Eugeny/russh on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track Eugeny/russh CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing