Russh, a Rust SSH client and server library, allows a remote peer to send malformed SSH identification strings that include arbitrary pre‑banner lines. Because the library does not enforce the SSH protocol’s canonical identification‑string format and does not limit the number of pre‑banner lines, an attacker can flood the pre‑authentication phase with excessive or specially crafted data. This input validation weakness (CWE‑20) can consume server resources and prolong connection setup, effectively denying service to legitimate users.

Eugeny’s russh library is affected. All releases from version 0.34.0-beta.1 up to, but not including, 0.61.0 are vulnerable. Any application that embeds russh as an SSH server should consider this range when assessing risk.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not disclosed, and the vulnerability is not listed in the CISA KEV catalog, implying no active exploitation at the time of publishing. The attack vector remains remote and requires only a standard SSH connection; an adversary could invoke the flaw by sending non‑canonical banners before the server responds. While no public exploit has been reported, the lack of early rejection could lead to resource exhaustion or keep the connection open in cleartext, making it a potential DoS vector.