CVE-2025-54804 Russh is missing an overflow check during channel windows adjust
A malicious client can crash an SSH server by triggering an integer overflow in the channel window adjustment logic of the Russh library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54804?
CVE-2025-54804 is a medium-severity vulnerability in Eugeny russh, published on 5 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.
Weakness: CWE-190
Which versions are affected by CVE-2025-54804?
2 open source packages ship an affected version, including russh. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
russh crates.io | All versions | 0.54.1 |
russh crates.io | All versions | 0.54.1 |
Products include Russh Project Russh, Warpgate Project Warpgate.
How do I fix CVE-2025-54804?
Upgrade russh to 0.54.1 or later.
Is CVE-2025-54804 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54804 exists.
Other vulnerabilities in Eugeny russh
Sources
Also known as GHSA-h5rc-j5f5-3gcm.