CVE-2025-54804 Details
Description
Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.
A vulnerability exists in the Russh SSH client and server library, specifically in versions prior to 0.54.1. The issue arises in the handling of the channel window adjust message, which is used to monitor the available space in the receive buffer of a channel. The current implementation improperly adds the received value to an internal state, leading to a potential integer overflow. When Rust code is compiled with overflow checks, this will cause a panic, allowing a malicious client to crash a server. While this vulnerability can also affect clients, causing them to crash when targeted by a malicious server, the impact on servers is more significant as it can disrupt service.
Users can upgrade to Russh version 0.54.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5 | [email protected] | Patch |
| https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| russh project russh | < 0.54.1 |
CPE
Remediation
| |
| warpgate project warpgate | < 0.16.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 13, 2025 | Initial Analysis | [email protected] |
| Aug 5, 2025 | CVE Modified | CISA-ADP |
| Aug 5, 2025 | New CVE Received | [email protected] |