Executive brief
A malicious SSH server can crash a Russh client session during the initial connection process. This occurs before the server's identity is even verified, allowing an attacker to prevent users from connecting to legitimate services or to disrupt automated SSH tasks. While the crash is limited to the specific connection and does not typically take down the entire application, it results in a reliable denial-of-service for all affected SSH traffic.
Technical details
The Russh SSH library's client-side implementation of the X25519 key exchange fails to validate the length of the ephemeral public key ('f' field) received from the server in the KEX_ECDH_REPLY message. When a server sends a key with a length other than 32 bytes, the `compute_shared_secret` function in `russh/src/kex/curve25519.rs` triggers a Rust panic during a `clone_from_slice` operation due to a slice length mismatch. This attack can be performed by any rogue SSH server or a Man-in-the-Middle (MitM) attacker before host key verification or authentication occurs. The panic is typically caught by the tokio runtime as a JoinError, terminating the specific connection task but not the entire process. The issue is fixed in version 0.62.4.
Affected products
- Eugeny russh <= 0.62.3
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Fixed in version 0.62.4
- 2026-07-24: advisory