{"id":"CVE-2026-116774","title":"russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)","summary":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writa…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-400","CWE-835"],"vendor":"Eugeny","product":"russh","affected":["russh >= 0.60.0, < 0.65.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T14:34:53.983359Z"},"published":"2026-10-27","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:13:18.607Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116774","references":[{"url":"https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42","label":"https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42"},{"url":"https://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c","label":"https://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c"},{"url":"https://github.com/Eugeny/russh/releases/tag/v0.65.0","label":"https://github.com/Eugeny/russh/releases/tag/v0.65.0"}],"tags":["cve.org"],"epss":0.00259,"epssPercentile":0.1763,"ingestedAt":"2026-10-27T20:56:38.457Z","slug":"CVE-2026-116774","body":"## Overview\n\nrussh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.\n\n## Affected\n\n- `russh >= 0.60.0, < 0.65.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}