{"schema":"threatline.record/2","record":{"id":"CVE-2026-116774","aliases":["GHSA-fw5c-8223-6h42"],"summary":"russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)","details":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.","categories":["Unclassified"],"product":"russh","vendor":"Eugeny","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116774","source_modified_at":"2026-10-27T20:25:26.914Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"russh","vendor":"Eugeny","versions":[{"version":">= 0.60.0, < 0.65.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T20:25:26.914Z","modified_at":"2026-10-27T20:25:26.914Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116774","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T20:25:26.914Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-fw5c-8223-6h42","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Eugeny/russh/commit/39cb9dbaa37caf555d34c6c22efa3bbbff9e186c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/Eugeny/russh/releases/tag/v0.65.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T20:25:26.914Z","content_hash":"a8da7d2904a9a5ed794a7dbdcf0a805abce3fdf382bc488cfd7c4fa2b62a9b78"}}