Pre-auth unbounded banner/identification buffering DoS
Published: October 05, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-r75w-7fhp-84w8
- Vendor Advisory: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-r75w-7fhp-84w8
GEM
PATCHED VERSIONS
~> 7.3, >= 7.3.5
>= 8.0.0.rc2
DESCRIPTION
Summary
Net::SSH::Transport::ServerVersion#read! appends each received byte to @version (@version << b) until \n, then copies to @header (@header << @version). No maximum line length or total byte cap is enforced. A malicious server sending a long identification line without LF causes unbounded client memory growth pre-authentication.
Credit
Reported by zhangph (afldl), 2026-07.
RELATED
- https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
- https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
- https://rubygems.org/gems/net-ssh/versions/7.3.5
- https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
- https://github.com/net-ssh/net-ssh/security/advisories/GHSA-r75w-7fhp-84w8