{"id":"CVE-2026-73489","title":"Russh is a Rust SSH client & server library","summary":"Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypt…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-129"],"vendor":"russh","product":"russh","affected":["russh < 0.62.4"],"patched":["russh 0.62.4"],"published":"2026-08-13","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73489","references":[{"url":"https://github.com/Eugeny/russh/commit/8912512371820167a12a0a638bd666856ce458ad","label":"security-advisories@github.com"},{"url":"https://github.com/Eugeny/russh/releases/tag/v0.62.4","label":"security-advisories@github.com"},{"url":"https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq","label":"security-advisories@github.com"},{"url":"https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/Eugeny/russh"}],"tags":["nvd","osv","rust"],"epss":0.00315,"epssPercentile":0.24657,"aliases":["GHSA-cqjc-rmpq-xprq"],"ecosystem":"rust","ingestedAt":"2026-08-13T19:18:22.058Z","slug":"CVE-2026-73489","body":"## Overview\n\nRussh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73489)\n\nAffected packages:\n\n- `russh < 0.62.4`\n\nPatched in:\n\n- `russh 0.62.4`\n\nSource: https://osv.dev/vulnerability/GHSA-cqjc-rmpq-xprq","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}