CVE-2026-116774

Name of the Vulnerable Software and Affected Versions russh versions 0.60.0 through 0.64.0

Description russh is a Rust SSH client and server library including an SSH agent protocol implementation. The channel-open parsing process accepts a peer-declared maximum packet size of zero, which is then passed to the poll writable() function in russh/src/channels/io/tx.rs. Consequently, the asynchronous write paths Channel::data, Channel::make writer, and Channel::into stream calculate a writable size of zero and remain pending indefinitely because window adjustments cannot satisfy a static zero packet maximum. This allows an authenticated client to strand server writes or a malicious server to strand client writes, causing affected tasks, channels, and connections to accumulate without triggering an error.

Recommendations Update to version 0.65.0.