Executive brief
Russh is a Rust library used to implement SSH servers and clients. A vulnerability in how the server handles terminal requests allows an authenticated user to crash the server by sending a specially crafted request with too many terminal-mode records. This results in a denial-of-service, preventing the server from processing further requests or maintaining availability for other users.
Technical details
A denial-of-service vulnerability exists in the `pty-req` handler of the Russh SSH server implementation. The parser in `russh/src/server/encrypted.rs` uses a fixed-size array of 130 entries to store terminal-mode records but fails to stop incrementing the index counter `i` when the array limit is reached. When the parser later attempts to slice the array using this unbounded counter (`&modes[0..i]`), it triggers an out-of-bounds panic. An attacker must be authenticated to reach this code path, but no special permissions beyond a standard session channel are required. The issue is fixed in version 0.62.4.
Affected products
- Eugeny russh <= 0.62.3
Timeline
- 2026-07-22: disclosed: Vulnerability identified in version 0.62.2 and main branch.
- 2026-07-22: advisory: GitHub Advisory GHSA-cqjc-rmpq-xprq published.
- 2026-07-24: patched: Version 0.62.4 released to address the issue.