Junglewise Threat Intelligence

CVE-2026-73489: Russh denial of service via malformed PTY request

CVE-2026-73489 · Severity: medium · CVSS 4.3 · Published 2026-08-13

Technologies: russh (crates.io). Vendors: crates.io, Eugeny.

Executive brief

Russh is a Rust-based SSH client and server library used for secure shell communications. An authenticated SSH client can crash the server session by sending a specially crafted PTY (pseudo-terminal) request containing more than 130 terminal-mode records, causing the session to terminate and become unavailable to legitimate users.

Technical details

The vulnerability is a denial-of-service bug in the PTY request handler within russh/src/server/encrypted.rs. The parser uses a fixed 130-entry array for storing terminal modes but fails to validate the incoming mode count before processing; it continues incrementing the mode counter beyond array bounds and constructs an out-of-bounds slice, triggering a panic. The panic terminates the session task without memory corruption. Attack requires an already-authenticated SSH client with network access to the server. The issue is fixed in version 0.62.4 by adding proper bounds checking before processing terminal modes.

Affected products

  • Eugeny Russh prior to 0.62.4

Timeline

  • 2026-08-13: disclosed
  • 2026-07-22: patched: Fixed in version 0.62.4

References

Related threats