{"action":"Upgrade russh to 0.62.4 or later.","affected":[{"fixed":"0.62.4","introduced":"0"}],"component":"russh","cve_ids":["CVE-2026-73489"],"ecosystem":"crates.io","epss":0.00451,"exploited":false,"fixed_versions":["0.62.4"],"ghsa_id":"GHSA-cqjc-rmpq-xprq","id":"tcs_01M5KEX02R3V97CPHBGB3G8HYS","modified_at":"2026-09-10T03:51:11.455167573Z","published_at":"2026-07-24T16:46:13Z","references":["https://osv.dev/vulnerability/GHSA-cqjc-rmpq-xprq","https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq","https://github.com/Eugeny/russh/commit/8912512371820167a12a0a638bd666856ce458ad","https://github.com/Eugeny/russh","https://github.com/Eugeny/russh/releases/tag/v0.62.4"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-cqjc-rmpq-xprq","url":"https://osv.dev/vulnerability/GHSA-cqjc-rmpq-xprq"}],"summary":"Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records"}