A vulnerability in russh allows an attacker to send a compressed SSH packet that decompresses to an excessively large size, causing the server or client to consume large amounts of memory. This occurs because the decompression output was not limited, enabling a small compressed packet to expand to hundreds of megabytes. The issue affects russh versions from 0.34.0 up to but not including 0.61.1. The flaw is fixed in version 0.61.1 by capping decompressed output size to 256 KiB plus header bytes, rejecting larger packets.