CVE-2025-54804: eugeny russh Integer Overflow or Wraparound

Vulnerability summary

CVE-2025-54804 is a medium (CVSS 6.5) Integer Overflow or Wraparound vulnerability in eugeny russh. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-08-2025
   PublishedVulnerability first disclosed.
2. 05-08-2025
   Last modifiedVulnerability information updated.

Description

Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.