The russh library versions >=0.34.0 and <0.61.0 contain an improper input validation vulnerability (CWE-20) where SSH message handlers decode attacker-controlled length-prefixed fields into owned allocations prior to bounds checking. This allows a remote SSH peer to send oversized or malformed fields that cause the library to allocate or process data unnecessarily before rejecting it, potentially leading to denial of service due to resource exhaustion. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability. The issue is fixed in version 0.61.0.

An attacker who can connect to a vulnerable russh client or server can send specially crafted SSH messages with oversized or malformed length-prefixed fields. This causes the library to allocate excessive memory or perform costly operations before rejecting the input, potentially resulting in denial of service by exhausting resources. There is no confidentiality or integrity impact reported.

Upgrade russh to version 0.61.0 or later, where this improper input validation vulnerability is patched. No other mitigation or workaround is indicated. Patch status is not explicitly stated but the fix is included in version 0.61.0.