This flaw occurs in the Russh client during the keyboard-interactive authentication path. A malicious SSH server can send a USERAUTH_INFO_REQUEST packet containing an attacker‑controlled prompt count. The client uses that raw count to allocate a vector before verifying that enough prompt data is actually present. The unchecked count can lead to an out‑of‑bounds allocation or a crash, causing the client or application to terminate unexpectedly.

The vulnerability affects the Russh library from version 0.37.0 up to, but excluding, 0.61.0. Only the Eugeny:russh product family is impacted.

The CVSS score of 6.5 marks this vulnerability as having moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, indicating limited public exploitation data. The attack can be performed by any entity running a rogue SSH server that connects to a client using the affected Ru ssh library. Exploitation would result in memory allocation errors and a crash, delivering a denial‑of‑service impact to the client side.