CVE-2025-54804: Russh Russh Is Missing Overflow Checks Vulnerability

MODERATE
Advisory Identifier: GHSA-h5rc-j5f5-3gcm
Share
CVSS 6.5
CWE-190
Published
Advisory Summary

CVE-2025-54804 is a MODERATE (CVSS 6.5) russh is missing overflow checks vulnerability (CWE-190: Integer Overflow or Wraparound) affecting Russh libraries in the crates.io ecosystem. The issue involves russh is missing overflow checks during channel windows adjust. Remediation is available by upgrading affected packages to version 0.54.1.

CVE-2025-54804 at a Glance

CVE Identifier CVE-2025-54804
GHSA Identifier GHSA-h5rc-j5f5-3gcm
Severity MODERATE
CVSS v3.1 Base Score 6.5
CWE Classification CWE-190: Integer Overflow or Wraparound
Affected Product Russh
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 6.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2025-54804

To remediate this vulnerability, upgrade all affected Russh dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

russh fixed: 0.54.1 
Upgrade russh to 0.54.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for russh

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-54804, inspect your project dependencies for Russh:

inspect dependencies for russh

Analyze the terminal output to locate any version of Russh in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.54.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In Russh, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. ### Details According https://datatracker.ietf.org/doc/html/rfc4254#section-5.2, The value must not overflow. The incorrect handling is done in server/encrypted.rs and client/encrypted.rs in the handling of CHANNEL_WINDOW_ADJUST. ``` let amount = map_err!(u32::decode(&mut r))?; ... channel.recipient_window_size += amount; ``` It could be replaced with something like ``` if let Some(ref mut channel) = enc.channels.get_mut(&channel_num) { // rfc 4254: The window MUST NOT be increased above 2^32 - 1 bytes. new_size = channel.recipient_window_size.saturating_add(amount); channel.recipient_window_size = new_size; } ... ``` ### PoC A customized client code would be required to send a message with a big value like u32_max. Not done yet. ### Impact This problem seems only critical to a server. One user can crash the server, which might take down the service. A malicious server could also crash a single client, but this seems not very critical.

CVE-2025-54804 Affected Russh Versions

1 component(s)
Fixed Versions:
0.54.1
Product / Package Ecosystem Affected Versions Fixed Version
russh
 crates.io
< 0.54.1
0.54.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm
NVD — CVE-2025-54804 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54804
Security Fix Commit FIX COMMIT
https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5
Russh Source Repository REPOSITORY
https://github.com/Eugeny/russh

Frequently Asked Questions

What is CVE-2025-54804?
CVE-2025-54804 is a security vulnerability in Russh involving russh is missing overflow checks during channel windows adjust under CWE-190: Integer Overflow or Wraparound.
Which Russh versions are affected?
Affected versions include releases prior to 0.54.1 across affected packages: russh.
What version fixes CVE-2025-54804?
Upgrading to 0.54.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is russh affected?
Yes, russh is affected in releases prior to 0.54.1. Upgrade your dependency to 0.54.1 or later.
What is the CVSS score of CVE-2025-54804?
CVE-2025-54804 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2025-54804?
CVE-2025-54804 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).
How can I check crates.io dependencies for CVE-2025-54804?
Run the dependency tree command: 'inspect dependencies for russh'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h5rc-j5f5-3gcm",
  "modified" : "2025-08-05T17:11:17Z",
  "published" : "2025-08-04T20:28:36Z",
  "aliases" : [ "CVE-2025-54804" ],
  "summary" : "russh is missing overflow checks during channel windows adjust",
  "details" : "### Summary\nThe channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic.  A malicious  client can crash a server. \n\n### Details\nAccording https://datatracker.ietf.org/doc/html/rfc4254#section-5.2, The value must not overflow. \nThe incorrect handling is done in server/encrypted.rs and client/encrypted.rs in the handling of CHANNEL_WINDOW_ADJUST. \n\n```\nlet amount = map_err!(u32::decode(&mut r))?;\n...\nchannel.recipient_window_size += amount;\n```\n\nIt could be replaced with something like \n\n```\n  if let Some(ref mut channel) = enc.channels.get_mut(&channel_num) {\n                        // rfc 4254: The window MUST NOT be increased above 2^32 - 1 bytes.\n                        new_size = channel.recipient_window_size.saturating_add(amount);\n                        channel.recipient_window_size = new_size;\n                    }\n...\n```\n\n### PoC\nA customized client code would be required to send a message with a big value like u32_max. Not done yet.\n\n### Impact\nThis problem seems only critical to a server. One user can crash the server, which might take down the service. A malicious server could also crash a single client, but this seems not very critical.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "russh"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.54.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-54804"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Eugeny/russh"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-190" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-08-04T20:28:36Z",
    "nvd_published_at" : "2025-08-05T01:15:42Z"
  }
}