Executive brief
Russh is a library used to implement SSH servers and clients in the Rust programming language. A vulnerability in how the library handles initial connection messages allows a remote attacker to send an unlimited number of invalid lines before identifying themselves. This can be used to consume server resources and keep connections open indefinitely, potentially leading to a denial of service for legitimate users.
Technical details
The russh library's identification reader (read_ssh_id) failed to enforce RFC 4253 requirements for server-side parsing. Specifically, it used the same permissive logic for both clients and servers, allowing clients to send pre-banner lines that should only be permitted from servers. Furthermore, the parser did not implement a limit on the number of pre-banner lines or strict line length limits. An unauthenticated remote attacker can exploit this by sending a continuous stream of non-SSH lines, keeping the connection in a pre-authentication state and consuming server resources. The vulnerability also functions as a parser-state oracle, allowing for cheaper fingerprinting of the server's parser behavior. The issue is fixed in version 0.61.0 by introducing stricter client-identification reading and explicit line count/length limits.
Affected products
- Eugeny russh >= 0.34.0-beta.1, < 0.61.0
Timeline
- 2026-05-20: disclosed
- 2026-06-10: advisory: NVD publication date
- 2026-06-11: patched: Version 0.61.0 released