Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the SSH identification string parsing logic of the russh library. The server-side implementation was overly permissive, allowing clients to send pre-banner text before the SSH identification string, which violates RFC 4253. This flaw was centered in the russh::SshRead::read_ssh_id function, which would discard any lines that were not valid SSH IDs without limit, allowing a client to keep a connection in a pre-authentication state indefinitely.
A remote, unauthenticated attacker could exploit this by sending a continuous stream of malformed lines, consuming server resources (CPU and memory) and leading to a denial-of-service condition. The fix, implemented in commit 3de4a68, segregates the parsing logic. A new, stricter function, russh::SshRead::read_client_ssh_id, was introduced for server-side use, which rejects any pre-banner lines from a client. The server's connection handling logic in russh::server::read_ssh_id was updated to use this new function, effectively patching the vulnerability. The analysis of the patch clearly shows the vulnerable function and how the fix was applied.
russh::SshRead::read_ssh_idrussh/src/ssh_read.rs
russh::server::read_ssh_idrussh/src/server/mod.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| russh | rust | >= 0.34.0-beta.1, < 0.61.0 | 0.61.0 |