A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker to bypass authentication attempt limits, facilitating brute-force credential guessing and placing an excessive workload on backend authentication systems.
Fix evidence last checked: 2026-10-02 10:35 UTC