CVE-2026-73489Medium· 4.3▾ SunlitRussh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypt…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.3%
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
russh < 0.62.4Patched in:
russh 0.62.4Connected by shared product, vendor, weakness, or advisory.
GHSA-cqjc-rmpq-xprqMedium· 4.3Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
CVE-2026-73429Medium· 5.3Russh is a Rust SSH client & server library
CVE-2026-73430Medium· 5.3Russh is a Rust SSH client & server library
GHSA-5xvq-cp9x-6p6rMedium· 5.3Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
GHSA-g9hv-x236-4qp3Medium· 5.3Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
CVE-2023-48795Medium· 5.9Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin