AIKIDO-2026-368658
russh is vulnerable to Improper Input Validation
75
High Risk
This Affects:
russhTL;DR
The russh SSH client processes channel-scoped messages such as CHANNEL_DATA, CHANNEL_EOF, CHANNEL_CLOSE, and CHANNEL_REQUEST without confirming that the referenced channel was actually opened, unlike the server side which validates channel identifiers. A malicious or compromised server can send lifecycle events for channel IDs the client never registered, reaching application handler callbacks with unknown channels. This lets a server spoof exit-status, exit-signal, or close notifications and desynchronize command-completion tracking, and can panic applications that index per-channel state by channel ID. The fix validates that a channel exists before invoking channel-scoped handler callbacks on the client.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use russh as an SSH client.
Background info
russh is vulnerable to Improper Input Validation in versions 0.0.1 - 0.63.0.
How to fix this
Upgrade the russh library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant