Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T22:17:26.893Z",
  "pubdate": "2026-08-13T22:17:26.893Z",
  "executiveSummary": "A denial of service vulnerability exists in the Russh SSH client and server library prior to version 0.62.4. The vulnerability involves an improper bounds check within the terminal mode parser, allowing an authenticated SSH client to trigger a panic and terminate the server session task.\nThe vulnerability type is an out-of-bounds array access leading to a panic-induced denial of service. The impact is restricted to availability, causing the termination of individual server sessions without resulting in memory corruption or arbitrary code execution.\nThe affected product is the Russh SSH library, specifically versions prior to 0.62.4. Risk implications are moderate, primarily affecting server availability for targeted sessions if attacked repeatedly.\nAttacker capabilities require valid authentication as an SSH client. Exploitation requirements include sending a specifically crafted pty-req channel request containing more than 130 terminal-mode records to the vulnerable server.",
  "technicalDetails": "The root cause of the vulnerability resides in the parsing logic located within russh/src/server/encrypted.rs. When processing an incoming SSH channel request of type pty-req, the parser stores terminal modes in a fixed-size array initialized as [(Pty::TTY_OP_END, 0); 130], which allocates a maximum capacity of 130 entries.\nVulnerable component and affected versions include the terminal mode parsing mechanism in Russh prior to version 0.62.4. Network exposure is inherent to SSH server implementations accepting authenticated channel requests.\nAuthentication and privilege requirements dictate that the attacker must already be an authenticated SSH client capable of establishing channels and issuing requests. No elevated privileges beyond standard client authentication are necessary.\nThe attack flow proceeds as follows: First, the authenticated attacker initiates an SSH session and sends a malicious pty-req channel request. Second, the payload behavior is embedded within the terminal-mode records of the request, exceeding the hardcoded threshold of 130 entries. Third, the parser continues to increment the mode count beyond the array bounds despite exceeding the 130-entry limit. Fourth, the application attempts to construct an out-of-bounds slice based on the inflated count. Finally, the Rust runtime catches the bounds violation, triggering a panic that terminates the server session task prior to the invocation of the application pty_request handler.\nPost-exploitation impact is strictly limited to denial of service via session termination. Because Rust panics safely unwind or abort the affected task rather than corrupting memory, the vulnerability does not facilitate remote code execution or unauthorized data access."
}