CVE-2026-116774: russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data, Channel::makewriter, and Channel::intostream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.65.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using russh versions from 0.60.0 up to, but not including, 0.65.0 are affected. Both client and server uses are exposed: an authenticated client can stall server writes, and a malicious server can stall client writes.
What must an attacker be able to do?
The attacker must be able to act as the SSH peer and declare a maximum packet size of zero during channel opening. Exploitation requires authentication when targeting a russh server; when targeting a russh client, the peer is a malicious server.
What is the operational impact of exploitation?
Affected asynchronous write operations can remain pending forever without returning an error. Tasks, channels, and connections can accumulate, resulting in availability degradation.
How can this be remediated?
Upgrade russh to version 0.65.0, which fixes the issue.