CVE-2026-73489: eugeny russh Improper Validation of Array Index

Vulnerability summary

CVE-2026-73489 is a medium (CVSS 4.3) Improper Validation of Array Index vulnerability in eugeny russh. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.8% of scored vulnerabilities.

Timeline

1. 13-08-2026
   PublishedVulnerability first disclosed.
2. 17-08-2026
   Last modifiedVulnerability information updated.

Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.