diff --color -ruNp a/ssh.c b/ssh.c
--- a/ssh.c	2025-12-10 11:51:34.927545274 +0100
+++ b/ssh.c	2025-12-10 12:05:26.210486999 +0100
@@ -599,6 +599,8 @@ valid_ruser(const char *s)
 	if (*s == '-')
 		return 0;
 	for (i = 0; s[i] != 0; i++) {
+		if (iscntrl((u_char)s[i]))
+			return 0;
 		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
 			return 0;
 		/* Disallow '-' after whitespace */