An SSH client library forwards lifecycle events for channel identifiers without checking whether the client actually owns or has established the channel. A malicious SSH server can send events for arbitrary, unused, or already closed channel IDs. The unvalidated callbacks can lead to application panics or corrupted command completion and exit‑code tracking, effectively creating a denial of service attack for programs that depend on accurate process outcome data.

The russh SSH library, curated by Eugeny, is affected in all versions prior to 0.63.1. Applications linking against those versions are vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is not available, but the lack of a published exploit in KEV and the necessity of a malicious SSH server for exploitation suggest a moderate to high likelihood of real‑world attacks. The vulnerability can be triggered remotely by an attacker controlling the SSH server and sending crafted channel events.