CVE-2026-73489
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Russh prior to version 0.62.4 has a denial-of-service vulnerability. An authenticated SSH client can send a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry array but continues increasing the mode count, leading to an out-of-bounds slice and panic before the pty_request handler runs.
Risk Assessment
An attacker can cause the SSH server session to terminate, leading to service unavailability for other users. However, there is no risk of memory corruption.
Recommendation
Update Russh to version 0.62.4 or later. Restrict access to the SSH server for untrusted clients.
Original NVD description (English source)
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.