CVE-2026-73489

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.62.4

Description An authenticated SSH client can trigger a denial of service by sending a pty-req channel request containing more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs utilizes a fixed 130-entry array to store terminal modes but continues to increment the mode count. This leads to the construction of an out-of-bounds slice, causing a panic that terminates the server session task. This process occurs before the application pty request handler is executed and does not result in memory corruption.

Recommendations Update to version 0.62.4.