Russh, a Rust SSH library, contains a flaw where compressed packets are validated only by their on‑wire length, not by their decompressed size. An attacker can send an SSH session that uses compression to deliver a packet whose compressed length satisfies transport checks but whose decompressed payload is vastly larger, triggering unexpected memory allocation and exhausting resources. The vulnerability is identified as CWE‑770, representing Excessive Resource Allocation.

The issue affects the russh library by Eugeny. Versions from 0.34.0 up to, but not including, 0.61.1 are vulnerable when SSH compression is enabled. Older releases prior to 0.58.0 used CryptoVec for decompression, which may exacerbate the impact. The patch is applied in version 0.61.1 and later.

With a CVSS score of 7.5 the vulnerability is considered high severity, though exploit probability is not quantified by EPSS. The vulnerability is not listed in CISA KEV, indicating no known public exploits yet. An attacker only needs to initiate an SSH connection with compression enabled and send the crafted packet; no authentication is required because the packet is processed during the transport layer. Successful exploitation results in a denial of service or resource exhaustion on the target system without compromising confidentiality or integrity.