Denial of Service Vulnerability in Russh Rust SSH Client & Server Library

CVE-2026-73489

What is CVE-2026-73489?

The Russh library, a Rust-based SSH client and server, is impacted by a vulnerability that allows an authenticated SSH client to trigger a denial of service. By sending a pty-req channel request with over 130 terminal-mode records, the server can encounter an out-of-bounds slice due to a fixed maximum entry limitation in its parser. When this occurs, the application panics and terminates the server session task, leading to a disruption in service. This issue has been resolved in version 0.62.4.

References