{"id":"EUVD-2026-111389","enisaUuid":"b046a34a-48bd-3058-a69e-fde3254c32a3","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.","datePublished":"Oct 27, 2026, 8:25:26 PM","dateUpdated":"Oct 28, 2026, 4:13:18 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42\nhttps://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c\nhttps://github.com/Eugeny/russh/releases/tag/v0.65.0\n","aliases":"CVE-2026-116774\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"ef06e5e8-6f33-3104-acb7-49841023b100","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"0.60.0, \u003c 0.65.0"}],"enisaIdVendor":[{"id":"637f86ba-d7a1-3c6d-bce0-acaf79acb40b","vendor":{"name":"Eugeny"}}],"enisaIdVulnerability":[{"id":"33ac028b-c679-3ee8-9645-105b44aefebf","vulnerability":{"id":"CVE-2026-116774","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.","datePublished":"Oct 27, 2026, 8:25:26 PM","dateUpdated":"Oct 28, 2026, 4:13:18 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42\nhttps://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c\nhttps://github.com/Eugeny/russh/releases/tag/v0.65.0\n","enisa_id":"EUVD-2026-111389\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Oct 30, 2026, 11:01:52 PM","vulnerabilityProduct":[{"id":"df395aac-f1aa-3e61-a40c-2dab4774515a","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"0.60.0, \u003c 0.65.0"}],"vulnerabilityVendor":[{"id":"16f94c63-e1f4-3886-9544-1e1bc89ab60e","vendor":{"name":"Eugeny"}}]}}],"enisaIdAdvisory":[]}