CVE-2024-43410: Russh has an OOM Denial of Service due to allocation of untrusted amount

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-08-21 · updated 2026-06-17
Weakness: CWE-770

Description

Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length, russh allocates enough memory for this bytestream, as a performance optimization to avoid reallocations later. But this length is entirely untrusted and can be set to any value by the client, causing this much memory to be allocated, which will cause the process to OOM within a few such requests. This vulnerability is fixed in 0.44.1.

Affected products

warp-tech russh: before 0.44.1 — fixed in 0.44.1
warp-tech warpgate: before 0.10.2 — fixed in 0.10.2

How to fix

Upgrade to a fixed version: warp-tech russh 0.44.1; warp-tech warpgate 0.10.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-43410 or the next vulnerability affects your stack