Denial of Service Vulnerability in Rust SSH Client and Server Library by Eugeny

CVE-2026-116774

What is CVE-2026-116774?

The Russh library, which is designed for SSH client and server functionalities, contains a vulnerability affecting versions 0.60.0 through 0.65.0. This issue arises from improper handling of a peer-declared maximum_packet_size, allowing a value of zero to be accepted during channel-open parsing. As a result, the library presents a writable size of zero in its various write paths, causing authentic clients to prevent server writes and a malicious server to block client writes. This could lead to tasks, channels, and connections accumulating indefinitely without any error message. The issue has been resolved in version 0.65.0.

References