What’s Vulnerable › Vulnerabilities

CVE-2026-73489: Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-10-24
• Weakness: CWE-129

Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.

Affected products

• Eugeny russh: before 0.62.4

References

• https://github.com/Eugeny/russh/commit/8912512371820167a12a0a638bd666856ce458ad
• https://github.com/Eugeny/russh/releases/tag/v0.62.4
• https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq
• https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq

Get alerted when CVE-2026-73489 or the next vulnerability affects your stack