A pre-authentication denial-of-service vulnerability in the Eugeny russh library allows unauthenticated attackers to crash affected servers with a single malformed packet, posing a high risk to service availability.

This is a resource allocation and memory management flaw stemming from the keyboard-interactive authentication handler, allowing unauthenticated attackers to trigger excessive memory consumption.

A successful exploit results in immediate denial of service, rendering SSH services unavailable to legitimate users and administrators. This can disrupt critical remote management operations and automated infrastructure workflows. The CVSS score of 7.5 reflects the high severity of network-accessible, unauthenticated service disruption.

Immediate Action: Update the crates.io/russh package to version 0.60.1 or later to resolve the resource exhaustion flaw.

Proactive Monitoring: Monitor server resource utilization and SSH daemon process stability for unexpected crashes or abnormal memory allocation spikes.

Compensating Controls: Implement strict network access controls, such as firewalls or VPN restrictions, to limit exposure of SSH endpoints to trusted sources.

Public Exploit Available: false

Given the high severity and potential for complete service disruption, organizations running vulnerable versions of the russh library should prioritize patching immediately. Upgrading to version 0.60.1 removes the vulnerability and secures the authentication handler against malformed input attacks.