Russh, a Rust SSH client and server library, contains a flaw where the configured maximum number of authentication attempts is incremented but never enforced for the USERAUTH_REQUEST path. An attacker can send consecutive authentication requests over a single connection beyond the advertised limit, thereby increasing brute‑force guesswork and the load on downstream authentication services. The weakness involves improper enforcement of an authorization policy, as identified by CWE-307.

The vulnerability affects all deployments of the russh library before version 0.62.6. The vendor Eugeny released a patch in the 0.62.6 release that corrects this issue.

With a CVSS base score of 3.7, the flaw is classified as moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated remote client can exploit the weakness by repeatedly issuing authentication requests on a single SSH connection, increasing the likelihood of a successful password guess and placing additional strain on the authentication backend. No further capability such as code execution is offered by this flaw.