I wonder if anyone's thrown a fuzzer at it.
[1] https://github.com/google/oss-fuzz/tree/master/projects/mosh
Reply on news.ycombinator.com