RUSTSEC-2024-0450

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2024-0450

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0450.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2024-0450

Aliases

Published

2024-08-14T12:00:00Z

Modified

2026-11-12T08:00:04Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Memory exhaustion from an unchecked SSH packet length

Details

When reading a packet, russh took the 4-byte packet length sent by the peer and sized its receive buffer from it without any upper bound. The length is fully controlled by the other side of the connection and is read before authentication, so an unauthenticated client can claim packets of up to about 4 GiB and make a server allocate that much memory per connection. A few such connections are enough to run the process out of memory.

From 0.44.1, lengths above 256 KiB are rejected with Error::PacketSize before the buffer is sized.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / russh

Package

Name: russh; View open source insights on deps.dev
Purl: pkg:cargo/russh

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.44.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}