ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-116774

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · russh: peer-declared zero maximum

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116774. EPSS is 0.26%. Act only if a listed version of russh: peer-declared zero maximum is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (russh: peer-declared zero maximum).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.26%
Remediation
Version ranges on file
Affected products
cargo russh · crates.io russh · rust russh

## Summary A peer can advertise in its channel-open message ( when attacking a server, when attacking a client). russh accepts the value without validation and copies it into the channel write state, where it caps the size of every outgoing data chunk. In the code path ( , used by , and ), a cap of 0 makes every write future stay forever: is always 0, and no future event can ever raise it (a static maximum packet size of 0 can never be satisfied by any amount of peer-granted window). The write neither completes nor errors, so the application task hangs silently. Every other write path in russh already treats as an error ( ): ( ) and the session packetizers ( and ). The path is the only one that lacks the guard - it contradicts the crate's own invariant. ## Root cause (1) Peer value accepted without validation: - ( ): stored as ( ); no range check. Same for at . - The only packet-size validation anywhere is an upper bound on the *local* config that merely logs ( , ). Nothing validates the peer's value - 0 passes silently. (2) The value flows into the channel write state verbatim: - Server: - , then . - Client: - ( ) and , consumed by ( ), which builds . - The write half hands the value to the writer: ( ) and ( ) pass to . (3) The hang - (current v0.64.1, byte-identical in v0.60.0): With , is always 0 regardless of and ; the task parks on the window notification, gets re-polled on every , recomputes 0, and parks again - forever. (4) The guard exists everywhere else: Note that ( ) goes through -> ( ) into the same , so the primary documented data API hangs as well; only the variants reach the guard. ## Attack scenarios - **Server (authenticated remote DoS)**: with the default configuration, an authenticated client opens a session channel advertising . Whenever the server application writes on that channel through (echo, shell prompts, SFTP - russh's own examples echo via ), the write future never completes. The handler task is stranded and no error surfaces, so applica

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cargo russhversion unspecified
  • crates.io russh0.60.0 → 0.65
  • rust russh>= 0.60.0, <= 0.64.1

How to fix CVE-2026-116774

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116774. EPSS is 0.26%. Act only if a listed version of russh: peer-declared zero maximum is installed.

Which versions are affected?

Compare what you have installed with 0.60.0 → 0.65, >= 0.60.0, <= 0.64.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-835: Infinite Loop. EPSS 0.26%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ## Summary A peer can advertise in its channel-open message ( when attacking a server, when attacking a client). russh accepts the value without validation and copies it into the channel write state, where it caps the size of every outgoing data chunk. In the code path ( , used by , and ), a cap of 0 makes every write future stay forever: is always 0, and no future event can ever raise it (a stati

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    russh fixed in 0.65

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    russh fixed in 0.65

  4. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ## Summary A peer can advertise in its channel-open message ( when attacking a server, when attacking a client). russh accepts the value without validation and copies it into the channel write state, where it caps the size of every outgoing data chunk. In the code path ( , used by , and ), a cap of 0 makes every write future stay forever: is always 0, and no future event can ever raise it (a stati

Sources

  • CVE.orgVulnerability recordCVE-2026-116774

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-fw5c-8223-6h42

    russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116774

    A peer can advertise maximum packet size = 0 in its channel-open message (CHANNEL_OPEN when attacking a server, CHANNEL_OPEN_CONFIRMATION when attacking a client). russh accepts the value without validation and copies it into the channel write state, where it caps the size of every outgoing data chunk. In the AsyncWrite code path (ChannelTx::poll_writable, used by Channel::data(), Channel::make_wr

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-fw5c-8223-6h42

    russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

    osv.dev

References

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • GitHub Advisory DatabaseNov 3, 2026
  • OpenSSF OSV / OSV ScannerNov 2, 2026
  • CVE.orgOct 31, 2026