Pre-auth unbounded transport packet_size leads to memory exhaustion
Published: October 05, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-pfqh-p9vh-wx4p
- Vendor Advisory: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-pfqh-p9vh-wx4p
GEM
PATCHED VERSIONS
~> 7.3, >= 7.3.5
>= 8.0.0.rc2
DESCRIPTION
Summary
net-ssh's transport packet reader trusts the 4-byte wire packet length without capping it against RFC 4253 §6.1 (35000 bytes). Pre-KEX (plaintext), a malicious server can declare an arbitrarily large packet length and stream data, causing unbounded client memory growth before authentication.
Credit
Reported by zhangph (afldl), 2026-07.
RELATED
- https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
- https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
- https://rubygems.org/gems/net-ssh/versions/7.3.5
- https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
- https://github.com/net-ssh/net-ssh/security/advisories/GHSA-pfqh-p9vh-wx4p