russh CVE-2026-73489
MEDIUM
GHSA-cqjc-rmpq-xprq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-accessible post-auth crash requires low-privilege credentials (PR:L/AV:N); impact is session-task panic only, no corruption or scope change (A:L/S:U/C:N/I:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.
AnalysisAI
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated SSH session - the attacker must possess credentials accepted by the target russh server (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3 Medium) accurately characterizes the vulnerability: network-reachable, low complexity, requiring only authenticated (low-privilege) access, with availability impact scoped to the individual session task rather than the entire server process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid SSH credentials connects to a russh-based server and opens a session channel using standard SSH tooling. They then issue a pty-req channel request (via the public Channel::request_pty() API or a crafted SSH message) carrying 131 or more terminal-mode records - 651+ bytes of well-formed but oversized payload - causing the server's parser to panic and terminate the session task. … |
| Remediation | Upgrade russh to version 0.62.4 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today