[GHSA] GHSA-m65r-rprj-r5rg (medium) — Russh: Channel-scoped server callbacks can be reached without an open channel

GHSA-m65r-rprj-r5rg Severity: medium CVE: CVE-2026-68930

Russh: Channel-scoped server callbacks can be reached without an open channel

There is a server-side channel state issue in `russh`.

After a client is authenticated, `russh` can dispatch channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. In the strongest reproduced case, the client does not sen