Executive brief
Russh is a widely-used SSH client and server library written in Rust. An unauthenticated remote attacker can cause the SSH server to crash by sending a specially crafted key exchange message before authentication completes, disrupting SSH service availability for all users attempting to connect.
Technical details
The vulnerability is a denial-of-service (panic) in Russh's Curve25519 key exchange (KEX) implementation. When a server receives SSH_MSG_KEX_ECDH_INIT with an all-zero Q_C (peer public key) value, the code fails to validate this invalid state. The Curve25519Kex::server_dh function computes a shared secret that is all zeros, then compute_exchange_hash calls encode_mpint which attempts to skip leading zero bytes and indexes out of bounds, causing a panic. This occurs before authentication, meaning any unauthenticated SSH client on the network can trigger it. The vulnerability was fixed in version 0.62.4 by validating Curve25519 keys and correcting mpint encoding logic.
Affected products
- Eugeny Russh before 0.62.4
Timeline
- 2026-08-12: disclosed: CVE-2026-73430 published
- 2026-07-22: patched: Fix released in version 0.62.4