CVE-2026-73429 in russh
Summary
by MITRE • 08/12/2026
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described affects russh, a Rust library implementing both SSH client and server functionality. This represents a critical denial-of-service condition that specifically targets SSH client implementations using the russh library. The flaw manifests when a malicious SSH server deliberately crafts a malformed KEX_ECDH_REPLY message during the key exchange phase of an SSH connection. The vulnerability stems from inadequate input validation within the client-side cryptographic implementation, creating a deterministic crash scenario that terminates client sessions without proper error handling.
The technical root cause resides in the Curve25519 key exchange implementation at russh/src/kex/curve25519.rs where the compute_shared_secret function processes server ephemeral values without length verification. Specifically, the decoded exchange.server_ephemeral value is directly passed to clone_from_slice without validating that it conforms to the expected 32-byte format required for Curve25519 operations. This omission creates a deterministic panic condition that occurs before any host key verification takes place, effectively preventing legitimate authentication from proceeding. The vulnerability aligns with CWE-129, which addresses improper validation of length of input buffers, and represents a classic example of insufficient bounds checking in cryptographic implementations.
The operational impact of this vulnerability extends beyond simple service disruption to create potential security implications for systems relying on russh clients. When exploited, the malicious server can cause client sessions to terminate abruptly with a JoinError, leaving the embedding process unaffected while the targeted client task crashes. This behavior creates confusion for administrators who may not immediately recognize that the crash is due to an intentional attack rather than a system failure. The vulnerability demonstrates how improper cryptographic validation can be weaponized to create reliable denial-of-service conditions against SSH clients, potentially enabling attackers to disrupt critical infrastructure communications.
Mitigation strategies should focus on immediate patching to version 0.62.4 or later, which implements proper length validation for the server ephemeral values in the key exchange process. Organizations should also consider implementing additional monitoring for unexpected client session terminations and ensure that their SSH client implementations include robust error handling that can gracefully manage malformed responses from servers. From an ATT&CK perspective, this vulnerability maps to T1499.004, which covers network disruption through service availability attacks, and highlights the importance of validating cryptographic inputs as part of secure coding practices. The fix demonstrates proper defensive programming by incorporating length validation before buffer operations, aligning with security best practices for cryptographic implementations in network protocols.