CVE-2026-111062: A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request

This is a missing check on the signature algorithm (improper verification of a cryptographic signature’s algorithm, CWE-347) in the server’s publickey authentication.

Who is impacted: applications that use russh as an SSH server and rely on the requested algorithm to restrict, record or audit user-key signature algorithms. For example:

• a server that refuses SHA-1 (ssh-rsa) signatures, as OpenSSH does by default since 8.8;
• a server that logs which algorithm a client authenticated with.

Such a server can be made to accept a SHA-1 signature, or to record rsa-sha2-512 for one, by any holder of a valid RSA key.

Not impacted:

• russh clients;
• authentication strength beyond the choice of hash, since a valid signature by the private key is still required;
• Te RSA keys were examined, the case where one key admits several signature algorithms (ssh-rsa, rsa-sha2-256, rsa-sha2-512). We did not test other key types.