Executive brief
Russh is a Rust library that implements SSH client and server functionality, widely used in applications that need to communicate securely over SSH. A malicious SSH server can send a malformed key exchange packet that causes a Russh client to crash and terminate its session, resulting in a denial of service. This prevents legitimate users from completing their SSH connection, though the wider application typically remains operational.
Technical details
The vulnerability is a denial-of-service condition in the Curve25519 key exchange implementation. When processing a KEX_ECDH_REPLY message, the client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs fails to validate the length of the server's ephemeral public key before calling clone_from_slice, causing a panic if the key is not exactly 32 bytes. This panic occurs before the server's host key is verified, allowing an unauthenticated attacker to crash client sessions. Attack vector is network-based and requires no authentication; a malicious or compromised SSH server can trigger the crash. The issue is fixed in version 0.62.4 by validating key lengths.
Affected products
- Eugeny Russh prior to 0.62.4
Timeline
- 2026-08-12: disclosed
- 2026-07-22: patched: Version 0.62.4 released with security fix