CVE-2026-102824: Russh hybrid ML-KEM key exchange validation bypass

CVE-2026-102824 · Severity: medium · CVSS 4.3 · Published 2026-09-29

Russh is a Rust SSH client and server library used to enable secure remote connections. A flaw in its hybrid key exchange mechanism allows an attacker to bypass security safeguards by forcing the encryption to rely on a single cryptographic algorithm, potentially weakening the connection if that algorithm is later compromised. An attacker with network access to an SSH connection can exploit this to weaken the security of data in transit.

Technologies: russh (crates.io), Eugeny Russh. Vendors: crates.io, Eugeny.

Quick answers

Is CVE-2026-102824 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102824 being exploited in the wild.
How severe is CVE-2026-102824?
Medium severity, with a CVSS score of 4.3, published 29 September 2026.
Which products and versions are affected?
russh (crates.io) < 0.63.0, SEMVER:introduced=0,fixed=0.63.0; Eugeny Russh before 0.63.0.
Is there a fix for CVE-2026-102824?
Yes. russh (crates.io): upgrade to 0.63.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102824 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102824?
Check whether you run russh (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • russh (crates.io): upgrade to 0.63.0 or later
    cargo update -p russh

Technical details

The hybrid ML-KEM 768 and X25519 key exchange implementation in russh/src/kex/hybrid_mlkem.rs fails to validate that peer X25519 public keys are non-zero, allowing an attacker to submit an all-zero 32-byte key in both server_dh and compute_shared_secret functions. This forces the X25519 contribution to the shared secret to zero, making the combined secret depend only on ML-KEM and defeating the intended hybrid fallback protection. The vulnerability requires network-level access to the SSH connection and is fixed in version 0.63.0.

Affected products

  • Eugeny russh before 0.63.0

Identifiers

  • CVE-2026-102824
  • GHSA-w3jg-pjxf-73p4

Timeline

  • 2026-08-21: patched: Fix committed to main branch (sanitize Curve25519 params)
  • 2026-08-21: patched: Version 0.63.0 released
  • 2026-09-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.