Sonicnew

**Name of the Vulnerable Software and Affected Versions** Russh versions prior to 0.63.1 **Description** A connection configured to permit `mac=none` can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates `needs mac()` only when MAC selection fails. A remote peer can send a packet with a decrypted length of zero, causing the `russh/src/cipher/mod.rs` file to shrink the previously read block before indexing `buffer.buffer[16..]`, which results in a panic and terminates the connection task. **Recommendations** Update to version 0.63.1.

**Name of the Vulnerable Software and Affected Versions** Russh versions prior to 0.63.1 **Description** The `client read authenticated` function in `russh/src/client/encrypted.rs` forwards several channel subtypes—including CHANNEL DATA, CHANNEL EXTENDED DATA, CHANNEL EOF, CHANNEL CLOSE, CHANNEL OPEN FAILURE, CHANNEL SUCCESS, CHANNEL FAILURE, and CHANNEL REQUEST (specifically exit-status, exit-signal, and xon-xoff)—to public `client::Handler` callbacks. This occurs without verifying if the `ChannelId` belongs to a channel that the client actually opened and established. Consequently, a malicious SSH server could send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, leading to application panics or the corruption of exit-code tracking and command completion. **Recommendations** Update to version 0.63.1.

**Name of the Vulnerable Software and Affected Versions** Netty (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.17.Final Netty (io.netty:netty-codec-http) versions prior to 4.1.138.Final **Description** An unbounded per-connection queue growth flaw exists in the `HttpServerCodec`. The codec tracks the HTTP method of unanswered pipelined requests; while the first 32 entries are bit-packed into a single long, subsequent entries are added to the `methodOverflowQueue` (an `ArrayDeque` with no size limit or rejection path). A remote, unauthenticated attacker can exploit this by pipelining HTTP/1.1 requests on a single connection and withholding reads to prevent responses from being flushed. This action allows the queue to grow without bound, leading to unbounded heap growth and a denial of service. **Recommendations** Update to version 4.2.18.Final. Update to version 4.1.138.Final.