Medium severity · published Aug 5, 2025
CVE-2025-54804
Russh is missing an overflow check during channel windows adjust
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
russh · Eugeny
< 0.54.1 · source: vendor, NVD
WA
Warpgate · Warpgate Project
before 0.16.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54804
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54804
Patch
https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5
Exploit
https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm
More from russh
8.3
CVE-2026-116794
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
7.5
CVE-2026-102823
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
7.5
CVE-2026-48110
Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds
7.5
CVE-2026-46702
Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
7.5
CVE-2026-46673
Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases