Pre-auth unbounded KEX packet queue leads to memory exhaustion
Published: October 05, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-ggxh-cfwq-5xqc
- Vendor Advisory: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-ggxh-cfwq-5xqc
GEM
PATCHED VERSIONS
~> 7.3, >= 7.3.5
>= 8.0.0.rc2
DESCRIPTION
Summary
Net::SSH::Transport::Session#poll_message pushes every packet received during key exchange that is not on the "allowed during KEX" list into an unbounded @queue (Array), with no size cap. A malicious server that completes KEXINIT (putting net-ssh into pending KEX) and then floods non-allowed packet types causes the client to queue all of them — a pre-authentication memory-exhaustion DoS.
Credit
Reported by zhangph (afldl), 2026-07.
RELATED
- https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
- https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
- https://rubygems.org/gems/net-ssh/versions/7.3.5
- https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
- https://github.com/net-ssh/net-ssh/security/advisories/GHSA-ggxh-cfwq-5xqc