CVE-2026-73489Medium· 4.3▾ SunlitRussh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypt…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
russh < 0.62.4Patched in:
russh 0.62.4Connected by shared product, vendor, weakness, or advisory.
GHSA-cqjc-rmpq-xprqMedium· 4.3Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
CVE-2026-102822Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-73429Medium· 5.3Russh is a Rust SSH client & server library
CVE-2026-73430Medium· 5.3Russh is a Rust SSH client & server library
CVE-2026-111062LowA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
CVE-2026-102825Low· 3.7Russh is a Rust SSH client and server library