Executive brief
Russh is a library used to build SSH clients and servers in the Rust programming language. A vulnerability in how it handles compressed data allows a remote attacker to send specially crafted packets that expand to an enormous size once opened. This can cause the application to consume excessive memory or crash, leading to a denial-of-service that disrupts secure communications.
Technical details
A resource exhaustion vulnerability exists in russh's SSH decompression path (RFC 4253). While the library enforces packet-length limits on the encrypted/compressed wire data, it failed to enforce a separate ceiling on the post-decompression payload size. An attacker can craft a compressed SSH_MSG_DEBUG packet that stays under the 256 KiB transport cap but expands beyond 128 MiB after decompression. In versions prior to 0.58.0, the use of CryptoVec in this path could lead to process aborts; in later versions, it results in unbounded memory allocation (Vec<u8>). The issue is reachable unauthenticated if the server advertises zlib support, as negotiation follows the client's preference. Fixed in version 0.61.1 by implementing an explicit 128 MiB post-decompression limit.
Affected products
- Eugeny russh >= 0.34.0, < 0.61.1
Timeline
- 2026-05-23: advisory: GitHub Security Advisory published by maintainer
- 2026-06-10: disclosed: CVE published to NVD
- 2026-06-10: patched: Fix released in version 0.61.1