Russh, a Rust library that implements SSH clients and servers, contains an index‑out‑of‑range bug that is triggered when a connection permits the MAC setting "none" yet negotiates a CTR or CBC block cipher that requires a MAC. The selection logic validates the need for a MAC only when MAC selection fails, allowing the insecure cipher to be chosen. When a remote party then transmits a packet that decrypts to a zero‑length payload, Russh attempts to slice its buffer twice and panics, terminating the connection task. The flaw result is a denial of service on the SSH session or the overall SSH service but does not grant code execution or data exfiltration.

The vulnerability affects implementations of Russh released by the vendor Eugeny in versions earlier than 0.63.1. Any deployment that uses the library and allows the mac=none configuration while negotiable ciphers include CTR or CBC is subject to the attack.

The CVSS score of 3.7 indicates low severity, and an EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote connection that establishes an SSH session with mac=none enabled and sends a crafted zero‑length packet. The exploit only causes a panic that terminates the process, requiring a restart to restore service and providing no opportunity for code execution or data theft.