{"id":"GHSA-h5rc-j5f5-3gcm","summary":"russh is missing overflow checks during channel windows adjust","details":"### Summary\nThe channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic.  A malicious  client can crash a server. \n\n### Details\nAccording https://datatracker.ietf.org/doc/html/rfc4254#section-5.2, The value must not overflow. \nThe incorrect handling is done in server/encrypted.rs and client/encrypted.rs in the handling of CHANNEL_WINDOW_ADJUST. \n\n```\nlet amount = map_err!(u32::decode(&mut r))?;\n...\nchannel.recipient_window_size += amount;\n```\n\nIt could be replaced with something like \n\n```\n  if let Some(ref mut channel) = enc.channels.get_mut(&channel_num) {\n                        // rfc 4254: The window MUST NOT be increased above 2^32 - 1 bytes.\n                        new_size = channel.recipient_window_size.saturating_add(amount);\n                        channel.recipient_window_size = new_size;\n                    }\n...\n```\n\n### PoC\nA customized client code would be required to send a message with a big value like u32_max. Not done yet.\n\n### Impact\nThis problem seems only critical to a server. One user can crash the server, which might take down the service. A malicious server could also crash a single client, but this seems not very critical.","aliases":["CVE-2025-54804"],"modified":"2026-09-10T03:50:27.096647420Z","published":"2025-08-04T20:28:36Z","database_specific":{"github_reviewed_at":"2025-08-04T20:28:36Z","nvd_published_at":"2025-08-05T01:15:42Z","cwe_ids":["CWE-190"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54804"},{"type":"WEB","url":"https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5"},{"type":"PACKAGE","url":"https://github.com/Eugeny/russh"}],"affected":[{"package":{"name":"russh","ecosystem":"crates.io","purl":"pkg:cargo/russh"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.54.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-h5rc-j5f5-3gcm/GHSA-h5rc-j5f5-3gcm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}