CVE-2026-73489

Executive Summary

CVE-2026-73489 is an authenticated denial-of-service (DoS) vulnerability in russh, a Rust SSH client and server library, affecting all versions prior to 0.62.4. An authenticated SSH client can send a pty-req channel request containing more than 130 terminal-mode records; the parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues incrementing the mode counter, then constructs an out-of-bounds slice that causes a Rust panic. The panic terminates the server-side session task before the application pty_request handler executes, producing a low-severity availability impact with no memory corruption or code execution. The vulnerability is fixed in russh 0.62.4 per a single-source OSV advisory; no public PoC, no exploit code, and no CISA KEV listing exist at the time of writing.

Technical Analysis

The vulnerable component is the SSH server-side session parser of the russh library. During SSH session establishment, a client may request pseudo-terminal allocation by sending an SSH_MSG_CHANNEL_REQUEST of request type pty-req on the session channel, per RFC 4254. The request payload includes a terminal-mode string: a 4-byte length followed by a sequence of (opcode, value) records, each record consisting of a one-byte opcode and an opcode-dependent value, terminated by the TTY_OP_END (0x00) sentinel.

The parser implemented in russh/src/server/encrypted.rs pre-allocates a fixed-capacity array of 130 terminal-mode records, initialized as [(Pty::TTY_OP_END, 0); 130]. The parsing logic copies each incoming terminal-mode record into this array and increments a mode counter. The flaw is that the counter is incremented without a bounds check against the fixed capacity of 130. If the authenticated client supplies more than 130 terminal-mode records, the counter exceeds the physical array size. Subsequently, the code constructs a slice over the array using the oversized counter as the end index. Because Rust enforces mandatory bounds checking on slice ranges in safe code, this operation triggers a runtime panic — typically a message of the form "range end index ... out of range for slice of length 130" — rather than writing past the buffer. The panic propagates and terminates the session task before the application-level pty_request handler is ever invoked.

This is classified as CWE-129 (Improper Validation of Array Index): the input-derived count of terminal-mode records is used as an index/length without validating it against the fixed array bounds. The security impact is limited to availability. The program aborts the session task in a controlled manner; there is no out-of-bounds read or write of the heap in the unsafe-memory sense, no memory corruption, and no privilege escalation. The main SSH listener and other concurrent sessions are unaffected, which is consistent with the CVSS availability subscore of Low (A:L).

The attack surface is any network-facing service that embeds the russh server component and accepts SSH connections. The trigger is a protocol-level message that any SSH client library can generate, and the parsing occurs deep inside the library before the embedding application can validate or reject the request. Notably, the precondition is successful SSH authentication: the client must complete user authentication before it can open a session channel and send a pty-req request. This is reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (base score 4.3). The payload is delivered inside the encrypted SSH channel, so the malicious pty-req content is not visible to passive network monitors.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-73489 as of this writing. The attack chain below is inferred from the vulnerability class and the NVD description; it is a prototype-level DoS rather than a known in-the-wild technique.

1. Reconnaissance and target identification. An attacker first identifies network-facing SSH services that embed russh. The SSH banner exchanged in cleartext at connection time typically advertises the library, e.g. SSH-2.0-russh-<version>. The attacker can use Shodan-style fingerprinting with dorks such as banner:"SSH-2.0-russh" or port:22 banner:"SSH-2.0-russh" to enumerate candidate targets running versions below 0.62.4.

2. Gaining the authenticated precondition. The attacker must present valid SSH credentials. This could involve compromised credentials, weak default accounts on a russh-based appliance, or a legitimate low-privileged account on a bastion, jump host, or terminal server. The CVSS PR:L component confirms that at least a low-privileged authenticated session is required; the vulnerability cannot be triggered by an unauthenticated client.

3. Triggering the flaw. After authentication, the attacker opens a session channel and sends an SSH_MSG_CHANNEL_REQUEST carrying a pty-req request whose terminal-mode string contains more than 130 terminal-mode records (each an opcode/value pair, terminated by TTY_OP_END). The parser in russh/src/server/encrypted.rs fills the fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array, keeps incrementing the mode counter past 130, and constructs a slice whose range exceeds the array bounds. The Rust runtime aborts the task with a panic before the application pty_request handler runs.

4. Post-exploitation impact. The panic terminates the server session task, dropping the attacker's session and any data associated with it. Since the panic does not propagate beyond the task, the SSH listener process remains alive; the impact is repeated per-session session teardown. An attacker can script rapid connect → authenticate → pty-req → reconnect cycles to generate continuous task churn, consuming CPU and scheduler resources, filling logs with panic messages, and potentially starving legitimate sessions if the embedding runtime multiplexes many tasks per thread. There is no confidentiality or integrity impact, no cross-session memory access, and no remote code execution. The attack is a protocol-level, deterministic crash of a single session task.

Impact Assessment

Business impact. CVE-2026-73489 is a service-availability issue with a deliberately limited blast radius. The CVSS score of 4.3 (Medium, per the CVSS v3.1 ordinal scale) is driven by a network-exploitable (AV:N), low-complexity (AC:L) trigger that requires valid credentials (PR:L), no user interaction (UI:N), and an unchanged security scope (S:U). Confidentiality and integrity are unaffected (C:N, I:N); only availability is reduced (A:L) because the panic kills a single session task rather than the whole process.

Affected systems. Any application embedding russh server functionality prior to 0.62.4 — including terminal servers, remote-administration gateways, CI/CD SSH executors, and SSH-based file-transfer services written in Rust. Because russh is a library, the vulnerable code is transitive: downstream products must rebuild against a fixed release. The OSV package entry lists the affected package range as unfixed (0 → unfixed), which means dependency scanners may still flag environments that have not explicitly upgraded.

Blast radius and likelihood. Repeated triggering of the panic can cause meaningful degradation on a busy service: log flooding, elevated CPU from connection setup/teardown cycling, and reduced availability for legitimate users. However, the authenticated precondition substantially narrows the attacker population, and the single-task crash model prevents a full-service outage. EPSS places the exploitation probability at 0.00259 (17.8th percentile of all CVEs), indicating a low current threat-modeling priority. The vulnerability is not listed in CISA KEV, no threat-actor campaigns have been attributed, and no exploit-in-the-wild evidence exists as of the report date.

Detection Guidance

A critical detection caveat applies: the malicious pty-req payload is transmitted inside the encrypted SSH channel, so network IDS rules cannot inspect the terminal-mode count or the pty-req string on the wire. Detection must therefore focus on (a) fingerprinting exposed russh instances so they can be prioritized for patching, and (b) server-side telemetry that observes the resulting Rust panic and the session-churn behavior. The rules below are heuristic and should be tuned to the embedding application's logging format.

Sigma Rule

title: Russh Server Panic on Out-of-Bounds Terminal Mode Array (CVE-2026-73489)
id: 4a8f7f18-6f1a-4c8e-9f2a-4be6af7c3f0d
status: experimental
description: >
  Detects Rust panic messages emitted by the russh SSH server when parsing a
  pty-req channel request containing more than 130 terminal-mode records.
  The panic terminates the SSH session task (CVE-2026-73489).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73489
author: Valters IT Threat Intelligence
date: 2026/06/01
logsource:
  category: application
  product: generic
detection:
  selection_panic_russh:
    message|contains|all:
      - "panicked at"
      - "russh"
      - "encrypted.rs"
  selection_oob_slice:
    message|contains|all:
      - "range end index"
      - "out of range"
      - "130"
  condition: selection_panic_russh and selection_oob_slice
falsepositives:
  - Applications that log the string "russh" in unrelated context (e.g., dependency version printouts)
  - Custom forks of russh that use a different array size and therefore panic with a different length value
level: medium
tags:
  - attack.t1499
  - cve.2026.73489
  - cwe.129

YARA Rule

/*
  CVE-2026-73489 — russh pty-req terminal-mode array panic.
  Intended use: hunt in server log archives, core dumps, and memory captures.
  NOT suitable for raw network traffic: the SSH channel is encrypted.
*/
rule CVE_2026_73489_russh_panic
{
    meta:
        description = "Detects artifacts of the russh server panic caused by out-of-bounds terminal-mode slice (CVE-2026-73489)"
        author = "Valters IT Threat Intelligence"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73489"
        cve = "CVE-2026-73489"
        score = 43
    strings:
        $s1 = "russh/src/server/encrypted.rs" ascii wide
        $s2 = "TTY_OP_END" ascii wide
        $s3 = "range end index" ascii wide
        $s4 = "slice of length 130" ascii wide
        $s5 = "panicked at" ascii wide
    condition:
        uint32(0) == 0x464C457F or uint16(0) == 0x5A4D or
        (any of ($s1, $s2) and any of ($s3, $s4, $s5))
}

Suricata IDS Rule

The exploitation payload is encrypted, so the following rules perform target fingerprinting and session-churn detection rather than raw payload matching. The first rule alerts when an SSH handshake advertises a russh software version; the second flags rapid repeated inbound SSH sessions, a behavior consistent with automated connect → panic → reconnect cycles.

alert ssh any any -> any any (msg:"ET DOS Potential russh SSH server exposure (CVE-2026-73489)"; ssh.software_version; content:"russh"; nocase; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73489; sid:202673489; rev:1;)

alert ssh any any -> any 22 (msg:"ET DOS Repeated SSH session churn against russh server (CVE-2026-73489)"; flow:established,to_server; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73489; sid:202673490; rev:1;)

Elastic Detection

EQL query for log-based detection of the panic signature:

logs-* where (
  (message like "*panicked at*" and message like "*russh*" and message like "*encrypted.rs*")
  or (message like "*range end index*" and message like "*slice of length 130*")
)

Complementary process-level query for SSH service behavior (requires the embedded binary to be named or invoked with a recognizable argument; tune to the environment):

process where event.type == "end" and process.exit_code != 0
  and (process.args : "*russh*" or process.name : "*russh*")

Splunk SPL Query

index=* (sourcetype=*ssh* OR sourcetype=*server* OR sourcetype=app*)
  ("panicked at" "russh" "encrypted.rs")
  OR ("range end index" "slice of length 130")
| stats count by host, source, sourcetype
| where count > 5
| sort - count

For session-churn monitoring on russh-exposed hosts:

index=* sourcetype=ssh* "SSH-2.0-russh"
| rex field=_raw "SSH-2\.0-russh-(?<russh_version>[^\s]+)"
| stats count by src_ip, dest_ip, russh_version
| where count > 20
| sort - count

Wazuh OSSEC Rule

<group name="russh,">
  <rule id="100734" level="10" frequency="5" timeframe="120">
    <match>panicked at|range end index|slice of length 130|russh/src/server/encrypted.rs</match>
    <description>CVE-2026-73489 attempt - russh SSH server panic (out-of-bounds terminal-mode array)</description>
    <group>ssh,dos,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED): the fix in russh 0.62.4 is asserted by a single source (OSV) and has not been independently confirmed. No vendor advisory, CNA title, or official vendor fix reference is available for this CVE, and the OSV package range is listed as unfixed. Treat the patch as high-probability but not yet fully verified.

1. Immediate mitigations.

   • Restrict network access to russh-based SSH services to trusted IP ranges and enforce strong authentication (MFA, key-based auth) to raise the bar for the PR:L authenticated precondition.
   • Reduce the blast radius by running russh-embedded services in containers or with per-session process isolation (e.g., seccomp, cgroups) so a session-task panic cannot affect co-tenant workloads.
   • Deploy the detection content above and alert on repeated panic messages or SSH session churn. No vendor workaround is documented (Workarounds: N/A); if the embedding application allows it, disable PTY allocation for untrusted roles, but note this is an application-level configuration decision, not a russh library option.

2. Patch and upgrade steps.

   • Verify the russh version in the dependency tree: inspect Cargo.lock (or equivalent lockfile) and confirm whether russh is pinned below 0.62.4.
   • Upgrade to russh 0.62.4 or later (cargo update -p russh), rebuild the service, and run a regression test of SSH session, PTY, and channel-request behavior prior to production rollout.
   • Because the patch is only single-source confirmed, test the 0.62.4 release in staging, and re-evaluate once a vendor/maintainer advisory or an independent confirmation is published.

3. Long-term hardening.

   • Add russh to the software bill of materials (SBOM) and subscribe to OSV/GitHub advisory feeds so future library-level flaws are visible before they are exploited.
   • Automate dependency scanning in CI/CD so that the fixed version is enforced across all downstream products that embed russh.
   • For any service accepting SSH connections, assume authenticated users are a threat surface: apply least-privilege accounts, session timeouts, rate limiting on new SSH connections, and centralized logging of Rust panics/task aborts for incident response.

References

1. National Vulnerability Database — CVE-2026-73489: https://nvd.nist.gov/vuln/detail/CVE-2026-73489
2. OSV Advisory — CVE-2026-73489 (patch claim source): https://osv.dev/vulnerability/CVE-2026-73489
3. russh package on crates.io (fixed version 0.62.4): https://crates.io/crates/russh
4. RFC 4254 — The Secure Shell (SSH) Connection Protocol (pty-req channel request and terminal-mode encoding): https://www.rfc-editor.org/rfc/rfc4254

CISA KEV status: NOT listed. No known threat-actor campaigns, no exploit-in-the-wild evidence, and no public PoC were identified as of this report. EPSS score 0.00259 (17.8th percentile) indicates a low near-term exploitation likelihood.