russh CVE-2026-73489

Exploitation requires a valid authenticated SSH session - the attacker must possess credentials accepted by the target russh server (PR:L per CVSS). The pty-req code path is reachable with the default server configuration and default crypto suite (curve25519-sha256 + chacha20-poly1305); no non-default feature flag, special channel type, or privileged role is required beyond basic session authentication. Limiting factors: (1) the attacker must first authenticate, which requires valid credentials or an authorized key; (2) each attack crashes only the individual session task in the Rust async runtime, not the entire server process - repeated attacks are needed to sustain disruption; (3) Rust's memory safety guarantees ensure the panic cannot be escalated to memory corruption or code execution.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3 Medium) accurately characterizes the vulnerability: network-reachable, low complexity, requiring only authenticated (low-privilege) access, with availability impact scoped to the individual session task rather than the entire server process. Scope:Unchanged (S:U) is well-chosen - Rust's task isolation ensures only the crashing session is affected. No EPSS score was provided in the input, but given this is a niche Rust library with a post-auth precondition, automated mass exploitation is unlikely. There is no CISA KEV entry, and no public exploit beyond the GHSA-documented proof-of-concept. The GHSA advisory confirms the PoC reproduces end-to-end against real russh 0.62.2, so exploitability is practical for any authenticated user. The risk is moderate for applications that expose russh-based SSH servers to potentially hostile authenticated users (e.g., multi-tenant SSH gateways); for tightly controlled environments where all authenticated clients are trusted, real-world risk is low.

An attacker with valid SSH credentials connects to a russh-based server and opens a session channel using standard SSH tooling. They then issue a pty-req channel request (via the public Channel::request_pty() API or a crafted SSH message) carrying 131 or more terminal-mode records - 651+ bytes of well-formed but oversized payload - causing the server's parser to panic and terminate the session task. The GHSA advisory confirms this is reproducible end-to-end against unmodified russh 0.62.2 using a real TCP connection.