AIKIDO-2026-368658

TL;DR

The russh SSH client processes channel-scoped messages such as CHANNEL_DATA, CHANNEL_EOF, CHANNEL_CLOSE, and CHANNEL_REQUEST without confirming that the referenced channel was actually opened, unlike the server side which validates channel identifiers. A malicious or compromised server can send lifecycle events for channel IDs the client never registered, reaching application handler callbacks with unknown channels. This lets a server spoof exit-status, exit-signal, or close notifications and desynchronize command-completion tracking, and can panic applications that index per-channel state by channel ID. The fix validates that a channel exists before invoking channel-scoped handler callbacks on the client.