CVE-2026-42189 is a high-severity vulnerability in russh versions prior to 0.60.1. It involves a pre-authentication memory allocation issue triggered by a malformed keyboard-interactive authentication response. An unauthenticated client can cause the server to allocate excessive memory, potentially leading to a denial of service due to out-of-memory conditions. The issue is fixed in russh version 0.60.1 by limiting the allocation based on actual packet data size.