The russh SSH client versions prior to 0.65 have a vulnerability in their handling of EXT_INFO packets during the pre-authentication phase. The client accumulates extension names from these packets into a vector without any limit or deduplication, allowing a malicious server to cause unbounded memory growth by sending many such packets. This can lead to denial of service via resource exhaustion. The issue is fixed in version 0.65.