{"id":"CVE-2025-54804","aliases":["GHSA-h5rc-j5f5-3gcm"],"url":"https://o3.security/vulnerability/CVE-2025-54804","summary":"Russh is missing an overflow check during channel windows adjust","details":"### Summary\nThe channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic.  A malicious  client can crash a server. \n\n### Details\nAccording https://datatracker.ietf.org/doc/html/rfc4254#section-5.2, The value must not overflow. \nThe incorrect handling is done in server/encrypted.rs and client/encrypted.rs in the handling of CHANNEL_WINDOW_ADJUST. \n\n```\nlet amount = map_err!(u32::decode(&mut r))?;\n...\nchannel.recipient_window_size += amount;\n```\n\nIt could be replaced with something like \n\n```\n  if let Some(ref mut channel) = enc.channels.get_mut(&channel_num) {\n                        // rfc 4254: The window MUST NOT be increased above 2^32 - 1 bytes.\n                        new_size = channel.recipient_window_size.saturating_add(amount);\n                        channel.recipient_window_size = new_size;\n                    }\n...\n```\n\n### PoC\nA customized client code would be required to send a message with a big value like u32_max. Not done yet.\n\n### Impact\nThis problem seems only critical to a server. One user can crash the server, which might take down the service. A malicious server could also crash a single client, but this seems not very critical.","published":"2025-08-05T00:05:20.971Z","modified":"2026-10-28T02:30:54.573251676Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"russh","fixedVersion":"0.54.1"}],"fix":{"url":"https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5","label":"Eugeny/russh@0eb5e40"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54804.json"},{"type":"ADVISORY","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54804"},{"type":"FIX","url":"https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5"},{"type":"PACKAGE","url":"https://github.com/Eugeny/russh"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:54.573251676Z"}}