Eugeny Russh denial of service via all-zero Curve25519 public value

Executive brief

Russh is a Rust library used to implement SSH servers and clients. A flaw in how it handles specific cryptographic handshake messages allows an unauthenticated remote attacker to crash the server by sending a single specially crafted packet. This results in a denial of service, preventing legitimate users from connecting to the SSH service.

Technical details

The vulnerability is a bounds-check panic (index out of bounds) in the `encode_mpint` function within `russh/src/kex/mod.rs`. During the Curve25519 key exchange (KEX), the library fails to validate if the peer's public value (`Q_C`) is all zeros, as required by RFC 7748 §6. If an attacker sends a 32-byte all-zero value, the resulting shared secret is also all zeros. When `compute_exchange_hash` calls `encode_mpint` on this shared secret, a loop intended to skip leading zeros increments the index `i` until it equals the length of the buffer. Subsequent access at `s[i]` triggers a Rust panic. This occurs before host-key verification or authentication, allowing a remote unauthenticated attacker to cause a denial of service. The issue is fixed in version 0.62.4.

Affected products

• Eugeny russh <= 0.62.3

Timeline

• 2026-07-22: disclosed: Vulnerability identified in main branch HEAD
• 2026-07-22: advisory: GitHub Advisory GHSA-5xvq-cp9x-6p6r published
• 2026-07-24: patched: Advisory updated to reflect patched version 0.62.4

References

• https://api.github.com/users/afldl
• https://github.com/afldl
• https://api.github.com/users/afldl/gists%7B/gist_id%7D
• https://api.github.com/users/afldl/repos
• https://avatars.githubusercontent.com/u/220292072?v=4
• https://api.github.com/users/afldl/events%7B/privacy%7D