Executive brief
Russh is a Rust library used to implement SSH clients and servers. A vulnerability in the client-side authentication process allows a malicious SSH server to crash or exhaust the resources of a connecting client. This occurs when the server sends a specially crafted request that forces the client to attempt an impossibly large memory allocation, leading to a denial-of-service.
Technical details
A vulnerability exists in the `russh` client's handling of `SSH_MSG_USERAUTH_INFO_REQUEST` packets during keyboard-interactive authentication. The client parses the `n_prompts` field and uses it directly in `Vec::with_capacity()` without verifying if the packet actually contains the corresponding amount of data. A malicious server can provide a large `u32` value for `n_prompts` in a small packet, causing the client to attempt a massive memory allocation (e.g., ~128GB), resulting in a crash or resource exhaustion. This is fixed in version 0.61.0 by validating that the declared prompt count is consistent with the remaining packet length.
Affected products
- Eugeny russh >= 0.37.0, < 0.61.0
Timeline
- 2026-05-20: disclosed
- 2026-06-10: advisory: NVD publication
- 2026-06-11: patched: GitHub Advisory published/updated with patch version 0.61.0