Russh, a Rust SSH client and server library, contains a pre‑authentication denial‑of‑service flaw in the server's keyboard‑interactive authentication handler. An attacker who connects to a russh‑based server can send a single malformed packet during the keyboard‑interactive phase, causing an unbounded memory allocation that crashes the server. The flaw is a classic memory exhaustion bug identified as CWE‑770 and CWE‑789, and it allows an attacker to disrupt service without authentication, affecting availability.

Russh versions prior to 0.60.1, distributed by the vendor Eugeny (Eugeny:russh), are affected when keyboard‑interactive authentication is enabled. The library is employed in SSH servers for 2FA/TOTP, and any server that incorporates russh before 0.60.1 and exposes this method is vulnerable.

With a CVSS score of 7.5 the vulnerability is of high severity, though no exploit probability score is currently available. The attack does not require credentials or complex setup; a simple malformed packet over a normal SSH connection will trigger the crash. Because the issue is not listed in the CISA KEV catalog and no public exploits are known, the immediate risk is low to moderate, but organisations that expose russh servers should patch promptly to avoid accidental denial of service.