Live › vulnerability › CVE-2026-116774
Go to dashboardrussh, a Rust SSH client and server library, accepts a zero maximum_packet_size when a channel opens, from version 0.60.0 through 0.65.0. Channel writes then wait forever, so an authenticated peer or a malicious server can pile up stuck tasks and connections without any error.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:29 UTC. All times on this page are UTC.
Applications that embed russh 0.60.0 through 0.64.x as an SSH client or server and write data over channels are exposed. A server that accepts SSH connections from authenticated users is the most likely place for a client to trigger the stall, and a client talking to an untrusted server can be stalled by that server. Teams that do not use russh, or run a patched 0.65.0 or later build, can skip it.
No product ranges from the sources yet.
cargo tree -i russh in the project to find the russh version in userussh entry between 0.60.0 and 0.64.x0.65.0 or later with cargo update -p russhEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-116774")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.