CVE-2026-73489

Received Received - Intake

Denial of Service in Russh via Malformed Pty-Req Channel Request

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73489

Affected Vendors & Products

Vendor	Product	Version / Range
russh	russh	to 0.62.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in the Russh SSH library. An authenticated client can send a malicious pty-req channel request with more than 130 terminal-mode records. The server's parser incorrectly handles this by storing modes in a fixed 130-entry array but continues counting, leading to an out-of-bounds slice and a panic that terminates the server session task.

Detection Guidance

This vulnerability can be detected by monitoring for crashes or panics in Russh SSH server instances when processing pty-req channel requests with excessive terminal-mode records. Check server logs for panic messages related to out-of-bounds array access in russh/src/server/encrypted.rs.

Impact Analysis

If you use Russh as an SSH server, an attacker with valid credentials could crash your SSH service by sending a specially crafted request. This would disrupt legitimate users' access to the server until it is restarted.

Mitigation Strategies

Upgrade Russh to version 0.62.4 or later to address the vulnerability. If immediate upgrade is not possible, restrict SSH access to trusted users and monitor for suspicious pty-req requests until patched.

Hi! I’m here to help you understand CVE-2026-73489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70