An authenticated SSH client can trigger a panic in the russh server implementation by sending a pty-req request with more than 130 terminal-mode records. The parser mistakenly builds an out‑of‑bounds slice after the internal counter exceeds the 130‑entry array, causing a panic before the application’s pty_request handler executes. The resulting panic terminates the server session task, leading to a denial of service, but does not corrupt memory or allow further exploitation.

The vulnerability affects the russh Rust SSH library, authored by Eugeny. All versions before 0.62.4 are impacted. Versions 0.62.4 and later contain a fixed parser that prevents the panic.

The CVSS score of 4.3 indicates a moderate severity. EPSS is not available, so exploitation likelihood is unknown but the vulnerability is straightforward to trigger: an attacker who can authenticate to an SSH server that incorporates russh can send a pty‑req packet with an excessively large terminal‑mode list to cause a server crash. The attack vector is remote and requires authenticated access to the SSH server. The vulnerability is not listed in the CISA KEV catalog, and there is no evidence of widespread exploitation yet.