Russh vulnerabilities

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, causing russh/src/cipher/mod.rs to shrink the previously read block before indexing buffer.buffer[16..], which panics and terminates the connection task.

In the russh library, which is a Rust SSH client and server, prior to version 0.60.1, there is a pre-authentication denial-of-service vulnerability in the keyboard-interactive authentication handler. A malicious client can crash any russh-based server implementing this authentication by sending a single malformed packet.

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload.

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.

Russh before 0.63.1, in client_read_authenticated, forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking.

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.

Russh prior to version 0.62.4 has a denial-of-service vulnerability. An authenticated SSH client can send a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry array but continues increasing the mode count, leading to an out-of-bounds slice and panic before the pty_request handler runs.

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an all-zero shared secret, after which compute_exchange_hash calls encode_mpint in russh/src/kex/mod.rs and indexes beyond the end of the input while skipping leading zero bytes. The resulting panic occurs before authentication and terminates the server key-exchange task. This issue is fixed in version 0.62.4.

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.

Russh library before version 0.62.5 dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed. The issue is fixed in version 0.62.5.

Vulnerability in the Russh library (Rust SSH client & server) from version 0.34.0 to before 0.61.0. A remote SSH peer can send oversized or malformed length-prefixed fields, causing memory allocation or attempted allocation before rejecting data, potentially leading to denial of service or other issues.

Russh before version 0.61.0 does not strictly enforce SSH identification-string rules. The server-side identification reader uses a permissive path, allowing pre-banner lines from clients and not bounding their number. A remote attacker can hold connection setup resources in the cleartext pre-authentication phase with malformed identification input.

Russh (Rust SSH client & server library) versions 0.37.0 through 0.61.0 contain a vulnerability in the keyboard-interactive authentication path. A malicious SSH server can send USERAUTH_INFO_REQUEST with a controlled prompt count, and the client uses that count directly in Vec::with_capacity(...) before validation, potentially causing memory issues.

Russh before version 0.61.0 has a vulnerability in the server authentication path where internal authentication state is not reset when the username or service changes between requests. This can affect later requests for a different (user, service).

The Russh Rust SSH library versions 0.34.0 through 0.61.1 have a vulnerability related to SSH compression. When compression is enabled, a remote peer can send a compressed packet that decompresses to a much larger size than allowed, leading to resource exhaustion.

A vulnerability in the Russh library (Rust SSH client & server) before version 0.60.3 in the CryptoVec class allows unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. Local SSH agents can feed attacker-controlled frame lengths before validation, and in older versions (before 0.58.0) remote SSH traffic also reached CryptoVec through transport and compression buffers.