Russh versions prior to 0.44.1 contain a vulnerability where the SSH packet length is unchecked, allowing an unauthenticated client to request extremely large packet sizes. This leads to memory exhaustion on the server due to unbounded buffer allocation. The issue is fixed in version 0.44.1 by rejecting packet lengths above 256 KiB.