{"action":"Upgrade russh to 0.64.0 or later.","affected":[{"fixed":"0.64.0","introduced":"0.34.0-beta.1"}],"component":"russh","cve_ids":["CVE-2026-111062"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.64.0"],"ghsa_id":"GHSA-j7h2-66j4-ghjf","id":"tcs_01M5JJ2NXEQYYQ6963WJJTAHZC","modified_at":"2026-10-19T17:15:04.300380668Z","published_at":"2026-10-19T17:06:29Z","references":["https://osv.dev/vulnerability/GHSA-j7h2-66j4-ghjf","https://github.com/Eugeny/russh/security/advisories/GHSA-j7h2-66j4-ghjf","https://github.com/Eugeny/russh/commit/a0ded76bdc352f8fbeaaeb175fb2a0c586fbc8f2","https://github.com/Eugeny/russh","https://github.com/Eugeny/russh/releases/tag/v0.64.0"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-j7h2-66j4-ghjf","url":"https://osv.dev/vulnerability/GHSA-j7h2-66j4-ghjf"}],"summary":"A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request"}