CVE-2026-116774— russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

Quick assessment

Affected

Eugeny russh

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

russh 是一个用 Rust 编写的 SSH 客户端和服务端库，其中包含了 SSH 代理协议（SSH agent protocol）的实现。在版本 0.60.0 到 0.65.0 之间，消息的解析逻辑会接受对端声明的最大数据包大小（maximum_packet_size）为零，并将该值传递给（位于）。随后，、和这些异步写入路径会计算出可写入大小为 0，并因此永久处于等待状态，因为窗口调整机制无法满足一个静态为零的最大数据包限制。这导致已认证的客户端可以阻塞服务端的写入操作，而恶意的服务端也可以阻塞客

CVSS 4.3 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

Source: CVE Program / CVE List V5

Vulnerability Description

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Eugeny	russh	>= 0.60.0, < 0.65.0	-

II. Public POCs for CVE-2026-116774

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116774

请登录查看更多情报信息。

Other References for CVE-2026-116774 (3)

https://github.com/Eugeny/russh/releases/tag/v0.65.0 x_refsource_MISC
https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42 x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116774

Same Patch Batch · Eugeny · 2026-10-27 · 4 CVEs total

CVE-2026-116773	4.3 MEDIUM	russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
CVE-2026-116696	3.3 LOW	russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONS
CVE-2026-116775	2.3 LOW	pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaust

IV. Related Vulnerabilities

Same product: russh

Same vendor: Eugeny

Same weakness: CWE-400