Threats tagged 'ghsa-fw5c-8223-6h42'

A vulnerability in russh versions 0.60.0 up to but not including 0.65 allows a peer to advertise a maximum packet size of zero in channel-open messages. This causes the AsyncWrite path to stall indefinitely because the write operation never completes or errors, leading to a silent hang of the application task. The issue arises from lack of validation of the peer-declared maximum packet size and inconsistent handling in the AsyncWrite code path. This can be exploited by an authenticated client against a server or by a malicious server against a client to cause a denial of service by hanging write operations.