CVE-2025-54804: russh is missing overflow checks during channel windows adjust

August 4, 2025 (updated August 5, 2025)

The channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server.

References

github.com/Eugeny/russh
github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5
github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm
github.com/advisories/GHSA-h5rc-j5f5-3gcm
nvd.nist.gov/vuln/detail/CVE-2025-54804

Code Behaviors & Features

Detect and mitigate CVE-2025-54804 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →