CyberRota Analysis
AI-GeneratedAuthenticated users of the Russh SSH client and server library prior to version 0.62.4 are vulnerable to a denial of service attack, which can be triggered by sending a pty-req channel request with more than 130 terminal-mode records. This flaw results in an out-of-bounds access that causes the server to panic and terminate the session, although it does not lead to memory corruption. Organizations utilizing Russh should prioritize upgrading to version 0.62.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.