Skip to content
Fencer Vulns
medium 6.5

CVE-2025-54804 json

Russh is missing an overflow check during channel windows adjust

published 2025-08-04 15 mo ago modified 2026-09-10 1 mo ago also GHSA-h5rc-j5f5-3gcm , EUVD-2025-23576

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.

Patch / fix

  • crates.io russh 0.54.1
  • russh_project russh 0.54.1
  • warpgate_project warpgate 0.16.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-54804 updated cvss 6.5

russh: Russh Integer Overflow Vulnerability

  • Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces-tech-preview/idea-rhel9
    affected: workaround, no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io russh
<0.54.1
0.54.1

Affected products

  • Eugeny russh

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.