Executive brief
Russh is a Rust-based SSH client and server library used for secure shell communications. An authenticated SSH client can crash the server session by sending a specially crafted PTY (pseudo-terminal) request containing more than 130 terminal-mode records, causing the session to terminate and become unavailable to legitimate users.
Technical details
The vulnerability is a denial-of-service bug in the PTY request handler within russh/src/server/encrypted.rs. The parser uses a fixed 130-entry array for storing terminal modes but fails to validate the incoming mode count before processing; it continues incrementing the mode counter beyond array bounds and constructs an out-of-bounds slice, triggering a panic. The panic terminates the session task without memory corruption. Attack requires an already-authenticated SSH client with network access to the server. The issue is fixed in version 0.62.4 by adding proper bounds checking before processing terminal modes.
Affected products
- Eugeny Russh prior to 0.62.4
Timeline
- 2026-08-13: disclosed
- 2026-07-22: patched: Fixed in version 0.62.4