Reposted by el_d33
Oh damn I had not seen the details of the MicroTik RCE: the client can send a public RSA key with correct N and e = 1 and the server will use it.
Two primitives/protocol things that would have prevented it: if RSA was defined with a fixed e, and if SSH clients sent a key hash instead.
github.com
CVE-2026-67276 - GitHub Advisory Database
RouterOS does not compare the complete RSA public key...
![They were a controversial fashion and faced criticism from several quarters. In 1368, Charles V of France issued an edict banning their construction and use in Paris. An English poem from 1388 complained that men were unable to kneel in prayer because their toes were too long.[37] The c. 1440 morality play Castle of Perseverance includes the footwear in the "advice" that Humanum Genus ("Mankind") gets from Superbia ("Pride"): "Look that thou blow mickle boasts with long crakows on thy shoes".[38][d]
In 1463, Edward IV passed a sumptuary law that "no knight under the state of a lord, esquire, gentleman, nor other person shall use nor wear after the... feast of Saint Peter any shoes or boots having pikes passing the length of two inches" (5 cm).[39][40] In 1465, they were banned in England altogether, so that all cordwainers and cobblers within the City of London and environs were prohibited from making shoes with pikes more than 2 inches long.[28]: 117 [41]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:cyyd366g3hrxp5rynixm2mm3/bafkreidl74nt4ljn32kjdkqloikhmeutkjvpjt3ehqhfmnxr75vkey2eue)
