CVE-2025-54804: Russh is missing an overflow check during channel windows adjust

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-05 · updated 2026-06-17
Weakness: CWE-190

Description

Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.

Affected products

warp-tech russh: before 0.54.1 — fixed in 0.54.1
warp-tech warpgate: before 0.16.0 — fixed in 0.16.0

How to fix

Upgrade to a fixed version: warp-tech russh 0.54.1; warp-tech warpgate 0.16.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-54804 or the next vulnerability affects your stack