Technical impact
Russh, a Rust SSH client and server library, contains a logic flaw that causes the server to dispatch channel‑scoped handler callbacks for channel IDs that were never opened or confirmed. This behavior could allow an attacker to trigger code that was intended only for authenticated channel traffic, potentially leading to unintended code execution or service disruption. The weakness is aligned with CWE‑666 (Data Flow or Logic Error), CWE‑696 (Incorrect Permission Checking), and CWE‑863 (Array Index Out of Bounds).
Affected Systems
All releases of the russh library prior to v0.62.5 are affected. Applications that embed russh in an SSH server or client component are at risk, regardless of the host environment. The issue was fixed in release v0.62.5.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an established SSH session in which the attacker can send a non‑existent channel ID. Upon receiving such a request, the server will blindly invoke the associated callback, which could lead to unintended code execution or a denial of service. While no widespread exploitation evidence exists, the moderate CVSS and remote vector warrant timely remediation.
Github GHSA