CVE-2026-73489: Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTYOPEND, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application ptyrequest handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.62.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73489?
CVE-2026-73489 has a medium severity rating of 4.3.
How do I fix CVE-2026-73489?
To fix CVE-2026-73489, update the Russh library to version 0.62.4 or later.
What type of vulnerability is CVE-2026-73489?
CVE-2026-73489 is categorized as an out-of-bounds read vulnerability.
What can an attacker exploit with CVE-2026-73489?
An authenticated attacker can exploit CVE-2026-73489 to cause a denial of service by sending a malformed pty-req channel request.
What is the affected component in CVE-2026-73489?
The affected component in CVE-2026-73489 is the Russh server library's terminal modes parser.